Update network_tunnel_manager.sh

update network tunnel manager script

scripts/network_tunnel_manager.sh

@@ -85,41 +85,26 @@ apply_iptables_rules() {
     echo "applying IPtables rules for $interface..."
     sleep 2
 
-    # INPUT rules - allow incoming connections TO the gateway from tunnel clients
-    # This is CRITICAL for mobile clients to reach the bandwidth controller at 10.1.0.1:51830
-    sudo iptables -I INPUT -i "$interface" -j ACCEPT
-    sudo ip6tables -I INPUT -i "$interface" -j ACCEPT
-
-    # NAT rules - for outbound traffic masquerading
     sudo iptables -t nat -A POSTROUTING -o "$network_device" -j MASQUERADE
-    sudo ip6tables -t nat -A POSTROUTING -o "$network_device" -j MASQUERADE
-
-    # FORWARD rules - allow traffic through the gateway
     sudo iptables -A FORWARD -i "$interface" -o "$network_device" -j ACCEPT
     sudo iptables -A FORWARD -i "$network_device" -o "$interface" -m state --state RELATED,ESTABLISHED -j ACCEPT
+
+    sudo ip6tables -t nat -A POSTROUTING -o "$network_device" -j MASQUERADE
     sudo ip6tables -A FORWARD -i "$interface" -o "$network_device" -j ACCEPT
     sudo ip6tables -A FORWARD -i "$network_device" -o "$interface" -m state --state RELATED,ESTABLISHED -j ACCEPT
 
     sudo iptables-save | sudo tee /etc/iptables/rules.v4
     sudo ip6tables-save | sudo tee /etc/iptables/rules.v6
-    
-    echo "IPtables rules applied successfully for $interface (including INPUT rules for bandwidth controller)."
 }
 
 check_tunnel_iptables() {
     local interface=$1
     echo "inspecting IPtables rules for $interface..."
     echo "---------------------------------------"
-    echo "IPv4 INPUT rules (for bandwidth controller):"
-    iptables -L INPUT -v -n | grep -E "$interface|Chain INPUT" | head -20
-    echo "---------------------------------------"
-    echo "IPv4 FORWARD rules:"
+    echo "IPv4 rules:"
     iptables -L FORWARD -v -n | awk -v dev="$interface" '/^Chain FORWARD/ || $0 ~ dev || $0 ~ "ufw-reject-forward"'
     echo "---------------------------------------"
-    echo "IPv6 INPUT rules (for bandwidth controller):"
-    ip6tables -L INPUT -v -n | grep -E "$interface|Chain INPUT" | head -20
-    echo "---------------------------------------"
-    echo "IPv6 FORWARD rules:"
+    echo "IPv6 rules:"
     ip6tables -L FORWARD -v -n | awk -v dev="$interface" '/^Chain FORWARD/ || $0 ~ dev || $0 ~ "ufw6-reject-forward"'
 }
 
@@ -238,6 +223,24 @@ configure_dns_and_icmp_wg() {
     echo "dns and icmp configuration completed."
 }
 
+enable_bandwidth_metadata_endpoint() {
+    echo "allowing inbound TCP on port 51830 on interface nymwg (IPv4 and IPv6)..."
+
+    # IPv4
+    sudo iptables -A INPUT -i "$wg_tunnel_interface" -p tcp --dport 51830 -j ACCEPT
+    sudo iptables -A OUTPUT -o "$wg_tunnel_interface" -p tcp --dport 51830 -j ACCEPT
+
+    # IPv6
+    sudo ip6tables -A INPUT -i "$wg_tunnel_interface" -p tcp --dport 51830 -j ACCEPT
+    sudo ip6tables -A OUTPUT -o "$wg_tunnel_interface" -p tcp --dport 51830 -j ACCEPT
+
+    echo "saving iptables rules..."
+    sudo iptables-save | sudo tee /etc/iptables/rules.v4
+    sudo ip6tables-save | sudo tee /etc/iptables/rules.v6
+
+    echo "allow rule for TCP/51830 on nymwg applied."
+}
+
 case "$1" in
 fetch_ipv6_address_nym_tun)
     fetch_ipv6_address "$tunnel_interface"
@@ -275,6 +278,9 @@ joke_through_wg_tunnel)
 configure_dns_and_icmp_wg)
     configure_dns_and_icmp_wg
     ;;
+enable_bandwidth_metadata_endpoint)
+    enable_bandwidth_metadata_endpoint
+    ;;
 adjust_ip_forwarding)
     adjust_ip_forwarding
     ;;
@@ -296,6 +302,7 @@ remove_duplicate_rules)
     echo "  joke_through_the_mixnet         - Fetch a joke via nymtun0."
     echo "  joke_through_wg_tunnel          - Fetch a joke via nymwg."
     echo "  configure_dns_and_icmp_wg       - Allows icmp ping tests for probes alongside configuring dns"
+    echo "  enable_bandwidth_metadata_endpoint        - Allow port to enable wireguard metadata endpoint"
     echo "  adjust_ip_forwarding            - Enable IPV6 and IPV4 forwarding"
     echo "  remove_duplicate_rules <interface> - Remove duplicate iptables rules. Valid interfaces: nymwg, nymtun0"
     exit 1