From 2d37c33a3d8c8244c9417a0e175debbc7492c56d Mon Sep 17 00:00:00 2001 From: serinko <97586125+serinko@users.noreply.github.com> Date: Mon, 24 Nov 2025 12:42:38 +0100 Subject: [PATCH 1/5] tweak docs commands --- .../operators/snippets/routing-conf.mdx | 20 ++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-) diff --git a/documentation/docs/components/operators/snippets/routing-conf.mdx b/documentation/docs/components/operators/snippets/routing-conf.mdx index ebb33e5ba9..44036091f4 100644 --- a/documentation/docs/components/operators/snippets/routing-conf.mdx +++ b/documentation/docs/components/operators/snippets/routing-conf.mdx @@ -62,7 +62,7 @@ Networking configuration across different ISPs and various operation systems doe New nym-node full configuration, Existing nym-node full configuration, - Step-by-step or Pprtial configuration + Step-by-step or Partial configuration ]} defaultIndex={0}> This design is meant for operators setting up a new node on a fresh machine and it will result with a complete server readiness for routing as Entry Gateway and Exit Gateway in both Mixnet and WireGuard mode. @@ -80,9 +80,14 @@ chmod +x network-tunnel-manager.sh && \ - **If you setting up a new node and not upgrading an existing one, keep it running and [bond](/operators/nodes/nym-node/bonding.mdx) your node now! Then come back here and follow the rest of the configuration.** -###### 3. Execute complete network configuration: +###### 3. Run command for configuration: +- For nodes with WireGuard enabled: ```sh -./network-tunnel-manager.sh complete_networking_setup +./network-tunnel-manager.sh complete_networking_configuration +``` +- For nodes with WireGuard disabled: +```sh +./network-tunnel-manager.sh full_tunnel_setup ``` @@ -98,9 +103,14 @@ chmod +x network-tunnel-manager.sh && \ ./network-tunnel-manager.sh --help ``` -###### 2. Execute complete network configuration: +###### 2. Run command for configuration: +- For nodes with WireGuard enabled: ```sh -./network-tunnel-manager.sh complete_networking_setup +./network-tunnel-manager.sh complete_networking_configuration +``` +- For nodes with WireGuard disabled: +```sh +./network-tunnel-manager.sh full_tunnel_setup ``` From 26f4dd8f39001ba8f7e8a8b06e842aeaa21b6206 Mon Sep 17 00:00:00 2001 From: benedettadavico Date: Mon, 24 Nov 2025 13:41:03 +0100 Subject: [PATCH 2/5] add another test --- .../nym-node-setup/network-tunnel-manager.sh | 33 +++++++++++++++++++ 1 file changed, 33 insertions(+) diff --git a/scripts/nym-node-setup/network-tunnel-manager.sh b/scripts/nym-node-setup/network-tunnel-manager.sh index 3a464dd9fa..9b3318c836 100644 --- a/scripts/nym-node-setup/network-tunnel-manager.sh +++ b/scripts/nym-node-setup/network-tunnel-manager.sh @@ -912,10 +912,43 @@ check_nym_exit_chain() { return $errors } +check_iptables_default_policies() { + info "checking base iptables default policies (INPUT/FORWARD)" + + local issues=0 + local input_policy forward_policy + + input_policy=$(iptables -S INPUT 2>/dev/null | awk 'NR==1 && $1=="-P" {print $3}') + forward_policy=$(iptables -S FORWARD 2>/dev/null | awk 'NR==1 && $1=="-P" {print $3}') + + if [[ -z "${input_policy:-}" ]]; then + error "unable to read INPUT default policy (iptables -S INPUT failed?)" + issues=1 + elif [[ "${input_policy^^}" != "DROP" ]]; then + error "INPUT default policy is ${input_policy^^}; expected DROP so traffic is only allowed by explicit rules." + issues=1 + else + ok "INPUT default policy is DROP" + fi + + if [[ -z "${forward_policy:-}" ]]; then + error "unable to read FORWARD default policy (iptables -S FORWARD failed?)" + issues=1 + elif [[ "${forward_policy^^}" != "DROP" ]]; then + error "FORWARD default policy is ${forward_policy^^}; expected DROP to ensure traffic only flows via NYM-EXIT rules." + issues=1 + else + ok "FORWARD default policy is DROP" + fi + + return $issues +} + check_firewall_setup() { info "checking ipv4 firewall ordering…" local errors=0 + check_iptables_default_policies || errors=1 check_forward_chain || errors=1 check_nym_exit_chain || errors=1 From 42c051dfa3e6165759f62fbaa0ddcf2505c108bc Mon Sep 17 00:00:00 2001 From: benedettadavico Date: Mon, 24 Nov 2025 13:44:28 +0100 Subject: [PATCH 3/5] add default output test --- scripts/nym-node-setup/network-tunnel-manager.sh | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/scripts/nym-node-setup/network-tunnel-manager.sh b/scripts/nym-node-setup/network-tunnel-manager.sh index 9b3318c836..852079ac09 100644 --- a/scripts/nym-node-setup/network-tunnel-manager.sh +++ b/scripts/nym-node-setup/network-tunnel-manager.sh @@ -916,10 +916,11 @@ check_iptables_default_policies() { info "checking base iptables default policies (INPUT/FORWARD)" local issues=0 - local input_policy forward_policy + local input_policy forward_policy output_policy input_policy=$(iptables -S INPUT 2>/dev/null | awk 'NR==1 && $1=="-P" {print $3}') forward_policy=$(iptables -S FORWARD 2>/dev/null | awk 'NR==1 && $1=="-P" {print $3}') + output_policy=$(iptables -S OUTPUT 2>/dev/null | awk 'NR==1 && $1=="-P" {print $3}') if [[ -z "${input_policy:-}" ]]; then error "unable to read INPUT default policy (iptables -S INPUT failed?)" @@ -941,6 +942,16 @@ check_iptables_default_policies() { ok "FORWARD default policy is DROP" fi + if [[ -z "${output_policy:-}" ]]; then + error "unable to read OUTPUT default policy (iptables -S OUTPUT failed?)" + issues=1 + elif [[ "${output_policy^^}" != "ACCEPT" ]]; then + error "OUTPUT default policy is ${output_policy^^}; expected ACCEPT" + issues=1 + else + ok "OUTPUT default policy is ACCEPT" + fi + return $issues } From de0ae687efae364a0a41b46ae1666e352236bf47 Mon Sep 17 00:00:00 2001 From: serinko <97586125+serinko@users.noreply.github.com> Date: Mon, 24 Nov 2025 14:24:04 +0100 Subject: [PATCH 4/5] docs: specify command desc --- .../docs/components/operators/snippets/routing-conf.mdx | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/documentation/docs/components/operators/snippets/routing-conf.mdx b/documentation/docs/components/operators/snippets/routing-conf.mdx index 44036091f4..f39379f7ab 100644 --- a/documentation/docs/components/operators/snippets/routing-conf.mdx +++ b/documentation/docs/components/operators/snippets/routing-conf.mdx @@ -81,11 +81,11 @@ chmod +x network-tunnel-manager.sh && \ - **If you setting up a new node and not upgrading an existing one, keep it running and [bond](/operators/nodes/nym-node/bonding.mdx) your node now! Then come back here and follow the rest of the configuration.** ###### 3. Run command for configuration: -- For nodes with WireGuard enabled: +- Nodes with **WireGuard enabled**: Configures interfaces (`nymtun0` and `nymwg`), IPv4 and IPv6 routing, WireGuard exit policy and does validation tests ```sh ./network-tunnel-manager.sh complete_networking_configuration ``` -- For nodes with WireGuard disabled: +- Nodes with **WireGuard disabled**: Does everything like the command above *without WireGuard exit policy* ```sh ./network-tunnel-manager.sh full_tunnel_setup ``` @@ -104,11 +104,11 @@ chmod +x network-tunnel-manager.sh && \ ``` ###### 2. Run command for configuration: -- For nodes with WireGuard enabled: +- Nodes with **WireGuard enabled**: Configures interfaces (`nymtun0` and `nymwg`), IPv4 and IPv6 routing, WireGuard exit policy and does validation tests ```sh ./network-tunnel-manager.sh complete_networking_configuration ``` -- For nodes with WireGuard disabled: +- Nodes with **WireGuard disabled**: Does everything like the command above *without WireGuard exit policy* ```sh ./network-tunnel-manager.sh full_tunnel_setup ``` From 00d0ae0b5bb3b7da3cb51b76a8f00e4bf05df4cf Mon Sep 17 00:00:00 2001 From: serinko <97586125+serinko@users.noreply.github.com> Date: Mon, 24 Nov 2025 14:35:00 +0100 Subject: [PATCH 5/5] docs: add noninteractive mode for quic setup --- .../snippets/quic-bridge-deployment-script-setup.mdx | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/documentation/docs/components/operators/snippets/quic-bridge-deployment-script-setup.mdx b/documentation/docs/components/operators/snippets/quic-bridge-deployment-script-setup.mdx index 592269d728..0fd62d033f 100644 --- a/documentation/docs/components/operators/snippets/quic-bridge-deployment-script-setup.mdx +++ b/documentation/docs/components/operators/snippets/quic-bridge-deployment-script-setup.mdx @@ -32,6 +32,10 @@ chmod +x quic_bridge_deployment.sh ```sh ./quic_bridge_deployment.sh full_bridge_setup ``` +- If you prefer a non-interactive mode, run the command with this variable (and skip next step): +```sh +NONINTERACTIVE=1 quick_bridge_deployment.sh full_bridge_setup +``` ###### 3. Follow the interactive prompts - Make sure you don't just press enter to insert default values if your setup is different, for example in case of path to the config file