GRIN/nym
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
develop
nym/scripts/nym-node-setup/network-tunnel-manager.sh
T
import this bde2b07d0d NTM: NIP-11 exit policy update (#6807)
2026-05-20 08:30:49 +00:00

1750 lines
57 KiB
Bash
Raw Permalink Blame History

#!/bin/bash
# nym host network firewall, tunnel and wireguard exit policy manager
# run this script as root
set -euo pipefail
set +o errtrace
###############################################################################
# colors (no emojis)
###############################################################################
GREEN='\033[0;32m'
RED='\033[0;31m'
YELLOW='\033[0;33m'
NC='\033[0m'
CYAN='\033[0;36m'
RESET='\033[0m'
info() {
printf "%b\n" "${YELLOW}[INFO] $*${NC}"
}
warn() {
printf "%b\n" "${YELLOW}[WARN] $*${NC}"
}
ok() {
printf "%b\n" "${GREEN}[OK] $*${NC}"
}
error() {
printf "%b\n" "${RED}[ERROR] $*${NC}"
}
###############################################################################
# safety: must run as root, jq
###############################################################################
if [ "$(id -u)" -ne 0 ]; then
error "This script must be run as root"
exit 1
fi
###############################################################################
# Logging
###############################################################################
LOG_FILE="/var/log/nym/network_tunnel_manager.log"
mkdir -p "$(dirname "$LOG_FILE")"
touch "$LOG_FILE"
chmod 640 "$LOG_FILE"
# rotate log if >10MB
if [[ -f "$LOG_FILE" && $(stat -c%s "$LOG_FILE") -gt 10485760 ]]; then
mv "$LOG_FILE" "${LOG_FILE}.1"
touch "$LOG_FILE"
chmod 640 "$LOG_FILE"
fi
echo "----- $(date '+%Y-%m-%d %H:%M:%S') START network-tunnel-manager -----" | tee -a "$LOG_FILE"
echo -e "${CYAN}Logs are being saved locally to:${RESET} $LOG_FILE"
echo -e "${CYAN}These logs never leave your machine.${RESET}"
echo "" | tee -a "$LOG_FILE"
# safe logger
log() {
echo "[$(date '+%Y-%m-%d %H:%M:%S')] $*" | tee -a "$LOG_FILE"
}
# global redirection, strip ANSI before writing to log
add_log_redirection() {
exec > >(tee >(sed -u 's/\x1b\[[0-9;]*m//g' >> "$LOG_FILE"))
exec 2> >(tee >(sed -u 's/\x1b\[[0-9;]*m//g' >> "$LOG_FILE") >&2)
}
add_log_redirection
trap 'log "ERROR: exit=$? line=$LINENO cmd=$(printf "%q" "$BASH_COMMAND")"' ERR
START_TIME=$(date +%s)
###############################################################################
# basic config
###############################################################################
NYM_CHAIN="NYM-EXIT"
POLICY_FILE="/etc/nym/exit-policy.txt"
EXIT_POLICY_LOCATION="https://nymtech.net/.wellknown/network-requester/exit-policy.txt"
TUNNEL_INTERFACE="${TUNNEL_INTERFACE:-nymtun0}"
WG_INTERFACE="${WG_INTERFACE:-nymwg}"
# Function to detect and validate uplink interface
detect_uplink_interface() {
local cmd="$1"
local dev
dev="$(eval "$cmd" 2>/dev/null | awk '{print $5}' | head -n1 || true)"
if [[ -n "$dev" && "$dev" =~ ^[a-zA-Z0-9._-]+$ ]]; then
echo "$dev"
else
echo ""
fi
}
# uplink device detection, can be overridden
# Backward compatibility:
# - NETWORK_DEVICE sets both IPv4 and IPv6 uplinks.
# Preferred overrides:
# - NETWORK_DEVICE_V4
# - NETWORK_DEVICE_V6
NETWORK_DEVICE="${NETWORK_DEVICE:-}"
NETWORK_DEVICE_V4="${NETWORK_DEVICE_V4:-${NETWORK_DEVICE:-}}"
NETWORK_DEVICE_V6="${NETWORK_DEVICE_V6:-${NETWORK_DEVICE:-}}"
if [[ -z "$NETWORK_DEVICE_V4" ]]; then
NETWORK_DEVICE_V4="$(detect_uplink_interface "ip -o route show default")"
fi
if [[ -z "$NETWORK_DEVICE_V4" ]]; then
NETWORK_DEVICE_V4="$(detect_uplink_interface "ip -o route show default table all")"
fi
if [[ -z "$NETWORK_DEVICE_V4" ]]; then
error "cannot determine ipv4 uplink interface. set NETWORK_DEVICE_V4 or NETWORK_DEVICE"
exit 1
fi
if [[ -z "$NETWORK_DEVICE_V6" ]]; then
NETWORK_DEVICE_V6="$(detect_uplink_interface "ip -6 -o route show default")"
fi
if [[ -z "$NETWORK_DEVICE_V6" ]]; then
NETWORK_DEVICE_V6="$(detect_uplink_interface "ip -6 -o route show default table all")"
fi
has_ipv6_uplink() {
[[ -n "${NETWORK_DEVICE_V6:-}" ]]
}
info "detected ipv4 uplink: $NETWORK_DEVICE_V4"
if has_ipv6_uplink; then
info "detected ipv6 uplink: $NETWORK_DEVICE_V6"
else
warn "could not determine ipv6 uplink interface. continuing with ipv4-only setup; ipv6-specific setup will be skipped and ipv6 tests may fail"
fi
###############################################################################
# shared helpers
###############################################################################
ensure_jq() {
info "checking for jq..."
if command -v jq >/dev/null 2>&1; then
ok "jq is already installed"
else
info "jq not found, installing..."
apt-get update -y
DEBIAN_FRONTEND=noninteractive apt-get install -y jq
if command -v jq >/dev/null 2>&1; then
ok "jq installed successfully"
else
error "failed to install jq"
exit 1
fi
fi
}
install_iptables_persistent() {
if ! dpkg -s iptables-persistent >/dev/null 2>&1; then
info "installing iptables-persistent"
apt-get update -y
DEBIAN_FRONTEND=noninteractive apt-get install -y iptables-persistent
else
ok "iptables-persistent is already installed"
fi
}
adjust_ip_forwarding() {
info "configuring ip forwarding via /etc/sysctl.d/99-nym-forwarding.conf"
install -m 0644 /dev/null /etc/sysctl.d/99-nym-forwarding.conf
cat > /etc/sysctl.d/99-nym-forwarding.conf <<EOF
net.ipv4.ip_forward=1
net.ipv6.conf.all.forwarding=1
EOF
sysctl --system
local v4 v6
v4=$(cat /proc/sys/net/ipv4/ip_forward 2>/dev/null || echo 0)
v6=$(cat /proc/sys/net/ipv6/conf/all/forwarding 2>/dev/null || echo 0)
if [[ "$v4" == "1" && "$v6" == "1" ]]; then
ok "ipv4 and ipv6 forwarding enabled"
else
error "warning: ip forwarding not fully enabled (ipv4=$v4 ipv6=$v6)"
fi
}
save_iptables_rules() {
info "saving iptables rules to /etc/iptables"
mkdir -p /etc/iptables
iptables-save > /etc/iptables/rules.v4
ip6tables-save > /etc/iptables/rules.v6
ok "iptables rules saved"
}
###############################################################################
# part 1: network tunnel manager (nymtun0 + nymwg base nat/forwarding)
###############################################################################
fetch_ipv6_address() {
local interface=$1
local ipv6_global_address
ipv6_global_address=$(ip -6 addr show "$interface" scope global | awk '/inet6/ {print $2}' | head -n 1)
if [[ -z "$ipv6_global_address" ]]; then
error "no globally routable ipv6 address found on $interface. please configure ipv6 or check your network settings"
exit 1
else
info "using ipv6 address: $ipv6_global_address"
fi
}
fetch_and_display_ipv6() {
local ipv6_address
if ! has_ipv6_uplink; then
warn "no ipv6 uplink detected; skipping ipv6 uplink address display"
return 0
fi
ipv6_address=$(ip -6 addr show "$NETWORK_DEVICE_V6" scope global | awk '/inet6/ {print $2}')
if [[ -z "$ipv6_address" ]]; then
error "no global ipv6 address found on $NETWORK_DEVICE_V6"
else
ok "ipv6 address on $NETWORK_DEVICE_V6: $ipv6_address"
fi
}
# dedupe / clean-up rules for an interface in FORWARD and NYM-EXIT
# keeps a single copy of each rule
remove_duplicate_rules() {
local interface="$1"
if [[ -z "$interface" ]]; then
error "Error: No interface specified. Usage: $0 remove_duplicate_rules <interface>"
exit 1
fi
info "detecting and removing duplicate rules for $interface in FORWARD and ${NYM_CHAIN}"
#
# ipv4
#
local rules_v4
rules_v4=$(iptables-save | grep -E "(-A FORWARD|-A $NYM_CHAIN)" | grep -F -- "$interface" || true)
if [[ -n "$rules_v4" ]]; then
info "processing ipv4 rules"
local tmp4
tmp4=$(mktemp)
printf "%s\n" "$rules_v4" | sort | uniq > "$tmp4"
local rule count cleaned chain rest match index
while IFS= read -r rule; do
[[ -z "$rule" ]] && continue
# FIX: protect grep from rule content becoming flags
count=$(printf "%s\n" "$rules_v4" | grep -F -- "$rule" | wc -l)
if [[ "$count" -gt 1 ]]; then
info "removing $((count - 1)) duplicate(s) of ipv4 rule: $rule"
for ((i=1; i<count; i++)); do
cleaned="${rule#-A }"
chain=$(echo "$cleaned" | awk '{print $1}')
rest=$(echo "$cleaned" | cut -d' ' -f2-)
read -ra RULE_ARR <<<"$rest"
if iptables -t filter -C "$chain" "${RULE_ARR[@]}" 2>/dev/null; then
iptables -t filter -D "$chain" "${RULE_ARR[@]}" && continue
fi
match=$(iptables -S | grep -F -- "$cleaned" | head -n1 || true)
if [[ -n "$match" ]]; then
chain=$(echo "$match" | awk '{print $2}')
index=$(iptables -L "$chain" --line-numbers | grep -F "$interface" | awk 'NR==1{print $1}')
if [[ -n "$index" ]]; then
iptables -D "$chain" "$index" 2>/dev/null || \
error "warning: failed deleting ipv4 duplicate via index ($chain $index)"
else
error "warning: unable to locate ipv4 duplicate index for: $rule"
fi
else
error "warning: could not reliably match ipv4 duplicate rule: $rule"
fi
done
fi
done < "$tmp4"
rm -f "$tmp4"
else
ok "no ipv4 rules found for $interface to deduplicate"
fi
#
# ipv6
#
local rules_v6
rules_v6=$(ip6tables-save | grep -E "(-A FORWARD|-A $NYM_CHAIN)" | grep -F -- "$interface" || true)
if [[ -n "$rules_v6" ]]; then
info "processing ipv6 rules"
local tmp6
tmp6=$(mktemp)
printf "%s\n" "$rules_v6" | sort | uniq > "$tmp6"
local rule count cleaned chain rule_spec match index
while IFS= read -r rule; do
[[ -z "$rule" ]] && continue
# FIX: protect grep from interpreting rule as flags
count=$(printf "%s\n" "$rules_v6" | grep -F -- "$rule" | wc -l)
if [[ "$count" -gt 1 ]]; then
info "removing $((count - 1)) duplicate(s) of ipv6 rule: $rule"
for ((i=1; i<count; i++)); do
cleaned="${rule#-A }"
chain="${cleaned%% *}"
rule_spec="${cleaned#"$chain" }"
read -ra RULE6_ARR <<<"$rule_spec"
if ip6tables -t filter -C "$chain" "${RULE6_ARR[@]}" 2>/dev/null; then
ip6tables -t filter -D "$chain" "${RULE6_ARR[@]}" && continue
fi
match=$(ip6tables -S | grep -F -- "$cleaned" | head -n1 || true)
if [[ -n "$match" ]]; then
chain=$(echo "$match" | awk '{print $2}')
index=$(ip6tables -L "$chain" --line-numbers | grep -F "$interface" | awk 'NR==1{print $1}')
if [[ -n "$index" ]]; then
ip6tables -D "$chain" "$index" 2>/dev/null || \
error "warning: failed deleting ipv6 duplicate via index ($chain $index)"
else
error "warning: unable to locate ipv6 duplicate index for: $rule"
fi
else
error "warning: could not match ipv6 duplicate rule reliably: $rule"
fi
done
fi
done < "$tmp6"
rm -f "$tmp6"
else
ok "no ipv6 rules found for $interface to deduplicate"
fi
ok "duplicate rule scan completed for $interface"
}
apply_iptables_rules() {
local interface=$1
info "applying iptables rules for $interface using ipv4 uplink $NETWORK_DEVICE_V4${NETWORK_DEVICE_V6:+ and ipv6 uplink $NETWORK_DEVICE_V6}"
sleep 1
# ipv4 nat and forwarding
iptables -t nat -C POSTROUTING -o "$NETWORK_DEVICE_V4" -j MASQUERADE 2>/dev/null || \
iptables -t nat -A POSTROUTING -o "$NETWORK_DEVICE_V4" -j MASQUERADE
# governed by NYM-EXIT, do not add a broad FORWARD ACCEPT
if ! iptables -C FORWARD -i "$interface" -o "$NETWORK_DEVICE_V4" -j "$NYM_CHAIN" 2>/dev/null; then
iptables -C FORWARD -i "$interface" -o "$NETWORK_DEVICE_V4" -j ACCEPT 2>/dev/null || \
iptables -I FORWARD 1 -i "$interface" -o "$NETWORK_DEVICE_V4" -j ACCEPT
fi
iptables -C FORWARD -i "$NETWORK_DEVICE_V4" -o "$interface" -m state --state RELATED,ESTABLISHED -j ACCEPT 2>/dev/null || \
iptables -I FORWARD 2 -i "$NETWORK_DEVICE_V4" -o "$interface" -m state --state RELATED,ESTABLISHED -j ACCEPT
# ipv6 nat and forwarding
if has_ipv6_uplink; then
ip6tables -t nat -C POSTROUTING -o "$NETWORK_DEVICE_V6" -j MASQUERADE 2>/dev/null || \
ip6tables -t nat -A POSTROUTING -o "$NETWORK_DEVICE_V6" -j MASQUERADE
# governed by NYM-EXIT, do not add a broad FORWARD ACCEPT
if ! ip6tables -C FORWARD -i "$interface" -o "$NETWORK_DEVICE_V6" -j "$NYM_CHAIN" 2>/dev/null; then
ip6tables -C FORWARD -i "$interface" -o "$NETWORK_DEVICE_V6" -j ACCEPT 2>/dev/null || \
ip6tables -I FORWARD 1 -i "$interface" -o "$NETWORK_DEVICE_V6" -j ACCEPT
fi
ip6tables -C FORWARD -i "$NETWORK_DEVICE_V6" -o "$interface" -m state --state RELATED,ESTABLISHED -j ACCEPT 2>/dev/null || \
ip6tables -I FORWARD 2 -i "$NETWORK_DEVICE_V6" -o "$interface" -m state --state RELATED,ESTABLISHED -j ACCEPT
else
warn "no ipv6 uplink detected; skipping ipv6 nat/forwarding rules for $interface"
fi
save_iptables_rules
}
check_tunnel_iptables() {
local interface=$1
info "inspecting iptables rules for $interface"
info "ipv4 forward chain:"
iptables -L FORWARD -v -n | awk -v dev="$interface" '/^Chain FORWARD/ || $0 ~ dev || $0 ~ "ufw-reject-forward"'
echo
info "ipv6 forward chain:"
ip6tables -L FORWARD -v -n | awk -v dev="$interface" '/^Chain FORWARD/ || $0 ~ dev || $0 ~ "ufw6-reject-forward"'
}
check_ipv6_ipv4_forwarding() {
local result_ipv4 result_ipv6
result_ipv4=$(cat /proc/sys/net/ipv4/ip_forward)
result_ipv6=$(cat /proc/sys/net/ipv6/conf/all/forwarding)
ok "ipv4 forwarding is $([ "$result_ipv4" == "1" ] && ok enabled || error not enabled)"
ok "ipv6 forwarding is $([ "$result_ipv6" == "1" ] && ok enabled || error not enabled)"
}
check_ip_routing() {
info "ipv4 routing table:"
ip route
info "---------------------------"
info "ipv6 routing table:"
ip -6 route
}
perform_pings() {
info "performing ipv4 ping to google.com"
ping -4 -c 4 google.com || error "ipv4 ping failed"
echo "---------------------------"
info "performing ipv6 ping to google.com"
ping6 -6 -c 4 google.com || error "ipv6 ping failed"
}
joke_through_tunnel() {
ensure_jq
local interface=$1
sleep 1
echo
info "checking tunnel connectivity and fetching a joke for $interface"
info "if this test succeeds, it confirms your machine can reach the outside world via ipv4 and ipv6"
info "probes and external clients may still see different connectivity to your nym node"
local ipv4_address ipv6_address joke
ipv4_address=$(ip addr show "$interface" | awk '/inet / {print $2}' | cut -d'/' -f1)
ipv6_address=$(ip addr show "$interface" | awk '/inet6 / && $2 !~ /^fe80/ {print $2}' | cut -d'/' -f1)
if [[ -z "$ipv4_address" && -z "$ipv6_address" ]]; then
error "no ip address found on $interface. unable to fetch a joke"
error "please verify your tunnel configuration and ensure the interface is up"
return 1
fi
if [[ -n "$ipv4_address" ]]; then
echo
echo "------------------------------------"
info "detected ipv4 address: $ipv4_address"
info "testing ipv4 connectivity"
echo
if ping -c 1 -I "$ipv4_address" google.com >/dev/null 2>&1; then
ok "ipv4 connectivity is working. fetching a joke"
joke=$(curl -s -H "Accept: application/json" --interface "$ipv4_address" https://icanhazdadjoke.com/ | jq -r .joke)
[[ -n "$joke" && "$joke" != "null" ]] && ok "ipv4 joke: $joke" || echo "failed to fetch a joke via ipv4"
else
error "ipv4 connectivity is not working for $interface. verify your routing and nat settings"
fi
else
error "no ipv4 address found on $interface. unable to fetch a joke via ipv4"
fi
if [[ -n "$ipv6_address" ]]; then
echo
echo "------------------------------------"
info "detected ipv6 address: $ipv6_address"
info "testing ipv6 connectivity"
echo
if ping6 -c 1 -I "$ipv6_address" google.com >/dev/null 2>&1; then
ok "ipv6 connectivity is working. fetching a joke"
joke=$(curl -s -H "Accept: application/json" --interface "$ipv6_address" https://icanhazdadjoke.com/ | jq -r .joke)
[[ -n "$joke" && "$joke" != "null" ]] && ok "ipv6 joke: $joke" || error "failed to fetch a joke via ipv6"
else
error "ipv6 connectivity is not working for $interface. verify your routing and nat settings"
fi
else
error "no ipv6 address found on $interface. unable to fetch a joke via ipv6"
fi
ok "joke fetching processes completed for $interface"
echo "------------------------------------"
sleep 3
echo
echo
info "connectivity testing recommendations"
info "- from another machine use wscat to test websocket connectivity on 9001"
info "- test udp connectivity on port 51822 (wireguard)"
info "- example: echo 'test' | nc -u <your-ip> 51822"
}
configure_dns_and_icmp_wg() {
info "allowing ping (icmp) and dns on this host"
iptables -C INPUT -p icmp --icmp-type echo-request -j ACCEPT 2>/dev/null || \
iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
iptables -C OUTPUT -p icmp --icmp-type echo-reply -j ACCEPT 2>/dev/null || \
iptables -A OUTPUT -p icmp --icmp-type echo-reply -j ACCEPT
iptables -C INPUT -p udp --dport 53 -j ACCEPT 2>/dev/null || \
iptables -A INPUT -p udp --dport 53 -j ACCEPT
iptables -C INPUT -p tcp --dport 53 -j ACCEPT 2>/dev/null || \
iptables -A INPUT -p tcp --dport 53 -j ACCEPT
save_iptables_rules
ok "dns and icmp configuration completed"
}
apply_smtps_465_rate_limit() {
info "adding SMTPS tcp/465 rules with rate limiting to ${NYM_CHAIN}"
# IPv4
iptables -A "$NYM_CHAIN" -p tcp --dport 465 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
iptables -A "$NYM_CHAIN" -p tcp --dport 465 -m conntrack --ctstate NEW -m hashlimit \
--hashlimit-upto 30/min --hashlimit-burst 60 --hashlimit-mode srcip --hashlimit-name smtps465v4 -j ACCEPT
iptables -A "$NYM_CHAIN" -p tcp --dport 465 -m conntrack --ctstate NEW -j REJECT --reject-with tcp-reset
# IPv6
ip6tables -A "$NYM_CHAIN" -p tcp --dport 465 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
ip6tables -A "$NYM_CHAIN" -p tcp --dport 465 -m conntrack --ctstate NEW -m hashlimit \
--hashlimit-upto 30/min --hashlimit-burst 60 --hashlimit-mode srcip --hashlimit-name smtps465v6 -j ACCEPT
ip6tables -A "$NYM_CHAIN" -p tcp --dport 465 -m conntrack --ctstate NEW -j REJECT --reject-with tcp-reset
ok "SMTPS tcp/465 installed: NEW <= 30/min burst 60 per srcip; overflow rejected; ESTABLISHED allowed"
}
###############################################################################
# part 2: host network firewall for nym services
###############################################################################
NETWORK_FIREWALL_COMMENT="NYM-NETWORK-FW"
HOST_SSH_PORT="${HOST_SSH_PORT:-22}"
NETWORK_FIREWALL_TCP_PORTS=("$HOST_SSH_PORT" 80 443 1789 1790 8080 9000 9001 41264)
NETWORK_FIREWALL_UDP_PORTS=(4443 51822 51264)
NETWORK_FIREWALL_WG_TCP_PORT=51830
validate_port_value() {
local name="$1"
local value="$2"
if ! [[ "$value" =~ ^[0-9]+$ ]] || (( 10#$value < 1 || 10#$value > 65535 )); then
error "invalid ${name}='${value}'. expected integer 1-65535"
exit 1
fi
}
validate_port_value "HOST_SSH_PORT" "$HOST_SSH_PORT"
build_network_firewall_status_pattern() {
local patterns=("$NETWORK_FIREWALL_COMMENT")
local port
for port in "${NETWORK_FIREWALL_TCP_PORTS[@]}" "${NETWORK_FIREWALL_UDP_PORTS[@]}" "$NETWORK_FIREWALL_WG_TCP_PORT"; do
patterns+=("dpt:${port}")
done
local IFS='|'
printf '%s' "${patterns[*]}"
}
delete_managed_input_rules() {
local cmd="$1"
while read -r rule; do
[[ -z "$rule" ]] && continue
local spec
spec="${rule#-A INPUT }"
$cmd -D INPUT $spec 2>/dev/null || true
done < <($cmd -S INPUT | grep -F -- "$NETWORK_FIREWALL_COMMENT" || true)
}
add_input_port_rule() {
local cmd="$1"
local port="$2"
local protocol="$3"
local iface="${4:-}"
if [[ -n "$iface" ]]; then
if ! $cmd -C INPUT -i "$iface" -p "$protocol" --dport "$port" -m conntrack --ctstate NEW -m comment --comment "$NETWORK_FIREWALL_COMMENT" -j ACCEPT 2>/dev/null; then
$cmd -A INPUT -i "$iface" -p "$protocol" --dport "$port" -m conntrack --ctstate NEW -m comment --comment "$NETWORK_FIREWALL_COMMENT" -j ACCEPT
ok "added $cmd INPUT $protocol port $port on $iface"
fi
else
if ! $cmd -C INPUT -p "$protocol" --dport "$port" -m conntrack --ctstate NEW -m comment --comment "$NETWORK_FIREWALL_COMMENT" -j ACCEPT 2>/dev/null; then
$cmd -A INPUT -p "$protocol" --dport "$port" -m conntrack --ctstate NEW -m comment --comment "$NETWORK_FIREWALL_COMMENT" -j ACCEPT
ok "added $cmd INPUT $protocol port $port"
fi
fi
}
configure_network_firewall() {
info "configuring host network firewall for nym node services"
delete_managed_input_rules iptables
delete_managed_input_rules ip6tables
local port
for port in "${NETWORK_FIREWALL_TCP_PORTS[@]}"; do
add_input_port_rule iptables "$port" tcp
add_input_port_rule ip6tables "$port" tcp
done
for port in "${NETWORK_FIREWALL_UDP_PORTS[@]}"; do
add_input_port_rule iptables "$port" udp
add_input_port_rule ip6tables "$port" udp
done
add_input_port_rule iptables "$NETWORK_FIREWALL_WG_TCP_PORT" tcp "$WG_INTERFACE"
add_input_port_rule ip6tables "$NETWORK_FIREWALL_WG_TCP_PORT" tcp "$WG_INTERFACE"
save_iptables_rules
ok "host network firewall configuration completed"
}
show_network_firewall_status() {
info "managed host network firewall rules"
local status_pattern
status_pattern="$(build_network_firewall_status_pattern)"
echo
info "ipv4 input rules:"
iptables -L INPUT -n -v --line-numbers | grep -E "(${status_pattern})" || true
echo
info "ipv6 input rules:"
ip6tables -L INPUT -n -v --line-numbers | grep -E "(${status_pattern})" || true
}
test_network_firewall_rules() {
info "testing host network firewall rules"
local failures=0
local port
for port in "${NETWORK_FIREWALL_TCP_PORTS[@]}"; do
if iptables -C INPUT -p tcp --dport "$port" -m conntrack --ctstate NEW -m comment --comment "$NETWORK_FIREWALL_COMMENT" -j ACCEPT 2>/dev/null; then
ok "ipv4 tcp port $port allowed"
else
error "ipv4 tcp port $port missing"
((failures++))
fi
if ip6tables -C INPUT -p tcp --dport "$port" -m conntrack --ctstate NEW -m comment --comment "$NETWORK_FIREWALL_COMMENT" -j ACCEPT 2>/dev/null; then
ok "ipv6 tcp port $port allowed"
else
error "ipv6 tcp port $port missing"
((failures++))
fi
done
for port in "${NETWORK_FIREWALL_UDP_PORTS[@]}"; do
if iptables -C INPUT -p udp --dport "$port" -m conntrack --ctstate NEW -m comment --comment "$NETWORK_FIREWALL_COMMENT" -j ACCEPT 2>/dev/null; then
ok "ipv4 udp port $port allowed"
else
error "ipv4 udp port $port missing"
((failures++))
fi
if ip6tables -C INPUT -p udp --dport "$port" -m conntrack --ctstate NEW -m comment --comment "$NETWORK_FIREWALL_COMMENT" -j ACCEPT 2>/dev/null; then
ok "ipv6 udp port $port allowed"
else
error "ipv6 udp port $port missing"
((failures++))
fi
done
if iptables -C INPUT -i "$WG_INTERFACE" -p tcp --dport "$NETWORK_FIREWALL_WG_TCP_PORT" -m conntrack --ctstate NEW -m comment --comment "$NETWORK_FIREWALL_COMMENT" -j ACCEPT 2>/dev/null; then
ok "ipv4 tcp port $NETWORK_FIREWALL_WG_TCP_PORT allowed on $WG_INTERFACE"
else
error "ipv4 tcp port $NETWORK_FIREWALL_WG_TCP_PORT missing on $WG_INTERFACE"
((failures++))
fi
if ip6tables -C INPUT -i "$WG_INTERFACE" -p tcp --dport "$NETWORK_FIREWALL_WG_TCP_PORT" -m conntrack --ctstate NEW -m comment --comment "$NETWORK_FIREWALL_COMMENT" -j ACCEPT 2>/dev/null; then
ok "ipv6 tcp port $NETWORK_FIREWALL_WG_TCP_PORT allowed on $WG_INTERFACE"
else
error "ipv6 tcp port $NETWORK_FIREWALL_WG_TCP_PORT missing on $WG_INTERFACE"
((failures++))
fi
return "$failures"
}
###############################################################################
# part 3: wireguard exit policy manager
###############################################################################
add_port_rules() {
local cmd="$1" # iptables or ip6tables
local port="$2"
local protocol="${3:-tcp}"
if [[ "$port" == *"-"* ]]; then
local start_port end_port
start_port=$(echo "$port" | cut -d'-' -f1)
end_port=$(echo "$port" | cut -d'-' -f2)
if ! $cmd -C "$NYM_CHAIN" -p "$protocol" --dport "$start_port:$end_port" -j ACCEPT 2>/dev/null; then
$cmd -A "$NYM_CHAIN" -p "$protocol" --dport "$start_port:$end_port" -j ACCEPT
ok "added $cmd $NYM_CHAIN $protocol port range $start_port:$end_port"
fi
else
if ! $cmd -C "$NYM_CHAIN" -p "$protocol" --dport "$port" -j ACCEPT 2>/dev/null; then
$cmd -A "$NYM_CHAIN" -p "$protocol" --dport "$port" -j ACCEPT
ok "added $cmd $NYM_CHAIN $protocol port $port"
fi
fi
}
exit_policy_install_deps() {
install_iptables_persistent
for item in iptables ip6tables ip grep sed awk wget curl; do
if ! command -v "$item" >/dev/null 2>&1; then
info "installing dependency: $item"
apt-get install -y "$item"
fi
done
}
create_nym_chain() {
info "creating nym exit policy chain $NYM_CHAIN"
# create/flush chain
if iptables -S "$NYM_CHAIN" >/dev/null 2>&1; then
iptables -F "$NYM_CHAIN"
else
iptables -N "$NYM_CHAIN"
fi
if ip6tables -S "$NYM_CHAIN" >/dev/null 2>&1; then
ip6tables -F "$NYM_CHAIN"
else
ip6tables -N "$NYM_CHAIN"
fi
# remove *all* FORWARD -> NYM-EXIT jumps
while read -r rule; do
spec="${rule#-A FORWARD }"
iptables -D FORWARD $spec 2>/dev/null || true
done < <(iptables -S FORWARD | grep -F " -j $NYM_CHAIN" || true)
while read -r rule; do
spec="${rule#-A FORWARD }"
ip6tables -D FORWARD $spec 2>/dev/null || true
done < <(ip6tables -S FORWARD | grep -F " -j $NYM_CHAIN" || true)
# remove broad ACCEPT rules for wg + tun outbound so NYM-EXIT is authoritative
iptables -D FORWARD -i "$WG_INTERFACE" -o "$NETWORK_DEVICE_V4" -j ACCEPT 2>/dev/null || true
iptables -D FORWARD -i "$TUNNEL_INTERFACE" -o "$NETWORK_DEVICE_V4" -j ACCEPT 2>/dev/null || true
if has_ipv6_uplink; then
ip6tables -D FORWARD -i "$WG_INTERFACE" -o "$NETWORK_DEVICE_V6" -j ACCEPT 2>/dev/null || true
ip6tables -D FORWARD -i "$TUNNEL_INTERFACE" -o "$NETWORK_DEVICE_V6" -j ACCEPT 2>/dev/null || true
fi
# install the correct hook for both wg + tun
iptables -I FORWARD 1 -i "$WG_INTERFACE" -o "$NETWORK_DEVICE_V4" -j "$NYM_CHAIN"
iptables -I FORWARD 1 -i "$TUNNEL_INTERFACE" -o "$NETWORK_DEVICE_V4" -j "$NYM_CHAIN"
if has_ipv6_uplink; then
ip6tables -I FORWARD 1 -i "$WG_INTERFACE" -o "$NETWORK_DEVICE_V6" -j "$NYM_CHAIN"
ip6tables -I FORWARD 1 -i "$TUNNEL_INTERFACE" -o "$NETWORK_DEVICE_V6" -j "$NYM_CHAIN"
ok "NYM-EXIT chain ready + IPv4/IPv6 FORWARD hooks installed for $WG_INTERFACE and $TUNNEL_INTERFACE"
else
warn "no ipv6 uplink detected; installing only IPv4 FORWARD hooks for $WG_INTERFACE and $TUNNEL_INTERFACE"
ok "NYM-EXIT chain ready + IPv4 FORWARD hooks installed for $WG_INTERFACE and $TUNNEL_INTERFACE"
fi
}
setup_nat_rules() {
info "setting up nat and forwarding rules for $WG_INTERFACE via ipv4 uplink $NETWORK_DEVICE_V4${NETWORK_DEVICE_V6:+ and ipv6 uplink $NETWORK_DEVICE_V6}"
if ! iptables -t nat -C POSTROUTING -o "$NETWORK_DEVICE_V4" -j MASQUERADE 2>/dev/null; then
iptables -t nat -A POSTROUTING -o "$NETWORK_DEVICE_V4" -j MASQUERADE
fi
if has_ipv6_uplink; then
if ! ip6tables -t nat -C POSTROUTING -o "$NETWORK_DEVICE_V6" -j MASQUERADE 2>/dev/null; then
ip6tables -t nat -A POSTROUTING -o "$NETWORK_DEVICE_V6" -j MASQUERADE
fi
else
warn "no ipv6 uplink detected; skipping ipv6 NAT setup for $WG_INTERFACE"
fi
# keep reverse RELATED,ESTABLISHED in FORWARD for return traffic.
if ! iptables -C FORWARD -i "$NETWORK_DEVICE_V4" -o "$WG_INTERFACE" -m state --state RELATED,ESTABLISHED -j ACCEPT 2>/dev/null; then
iptables -I FORWARD 2 -i "$NETWORK_DEVICE_V4" -o "$WG_INTERFACE" -m state --state RELATED,ESTABLISHED -j ACCEPT
fi
if has_ipv6_uplink; then
if ! ip6tables -C FORWARD -i "$NETWORK_DEVICE_V6" -o "$WG_INTERFACE" -m state --state RELATED,ESTABLISHED -j ACCEPT 2>/dev/null; then
ip6tables -I FORWARD 2 -i "$NETWORK_DEVICE_V6" -o "$WG_INTERFACE" -m state --state RELATED,ESTABLISHED -j ACCEPT
fi
fi
}
configure_exit_dns_and_icmp() {
info "ensuring dns and icmp are allowed inside nym exit chain"
# remove any existing DNS/ICMP rules first to avoid duplicates
iptables -D "$NYM_CHAIN" -p udp --dport 53 -j ACCEPT 2>/dev/null || true
iptables -D "$NYM_CHAIN" -p tcp --dport 53 -j ACCEPT 2>/dev/null || true
iptables -D "$NYM_CHAIN" -p icmp --icmp-type echo-request -j ACCEPT 2>/dev/null || true
iptables -D "$NYM_CHAIN" -p icmp --icmp-type echo-reply -j ACCEPT 2>/dev/null || true
ip6tables -D "$NYM_CHAIN" -p udp --dport 53 -j ACCEPT 2>/dev/null || true
ip6tables -D "$NYM_CHAIN" -p tcp --dport 53 -j ACCEPT 2>/dev/null || true
ip6tables -D "$NYM_CHAIN" -p ipv6-icmp -j ACCEPT 2>/dev/null || true
# insert rules at the beginning in correct order: DNS first, then ICMP
iptables -I "$NYM_CHAIN" 1 -p udp --dport 53 -j ACCEPT
iptables -I "$NYM_CHAIN" 2 -p tcp --dport 53 -j ACCEPT
iptables -I "$NYM_CHAIN" 3 -p icmp --icmp-type echo-request -j ACCEPT
iptables -I "$NYM_CHAIN" 4 -p icmp --icmp-type echo-reply -j ACCEPT
ip6tables -I "$NYM_CHAIN" 1 -p udp --dport 53 -j ACCEPT
ip6tables -I "$NYM_CHAIN" 2 -p tcp --dport 53 -j ACCEPT
ip6tables -I "$NYM_CHAIN" 3 -p ipv6-icmp -j ACCEPT
}
apply_port_allowlist() {
echo "applying allowed port list into ${NYM_CHAIN}"
configure_exit_dns_and_icmp
declare -A PORT_MAPPINGS=(
["FTP"]="20-21"
["SSH"]="22"
["WHOIS"]="43"
["DNS"]="53"
["Finger"]="79"
["HTTP"]="80-81"
["Kerberos"]="88"
["POP3"]="110"
["UseNet1"]="119"
["NTP"]="123"
["IMAP"]="143"
["IMAP3"]="220"
["SSHAlternative1"]="223"
["LDAP"]="389"
["HTTPS"]="443"
["SMBWindowsFileShare"]="445"
["Kpasswd"]="464"
# this port is opened and rate limited in apply_smtps_465_rate_limit
# ["SMTP"]="465"
["RTSP"]="554"
["UseNet2"]="563"
["SMTPSubmission"]="587"
["TelegramVoiceVideo"]="596-599"
["LDAPS"]="636"
["SILC"]="706"
["KerberosAdmin"]="749"
["DNSOverTLS"]="853"
["Rsync"]="873"
["VMware"]="902-904"
["RemoteHTTPS"]="981"
["FTPOverTLS"]="989-990"
["NetnewsAdmin"]="991"
["TelnetOverTLS"]="992"
["IMAPOverTLS"]="993"
["POP3OverTLS"]="995"
["WorldOfWorldcraft1"]="1119-1120"
["OpenVPN"]="1194"
["WireGuardPeer"]="51820-51822"
["QTServerAdmin"]="1220"
["PKTKRB"]="1293"
["TelegramMTProto"]="1400"
["MSSQL"]="1433"
["VLSILicenseManager"]="1500"
["OracleDB"]="1521"
["Sametime"]="1533"
["GroupWise"]="1677"
["PPTP"]="1723"
["RTSPAlt"]="1755"
["MSNP"]="1863"
["Gemini"]="1965"
["NFS"]="2049"
["DiscordVoiceChat2"]="2053"
["CPanel"]="2082-2083"
["GNUnet"]="2086-2087"
["NBX"]="2095-2096"
["Zephyr"]="2102-2104"
["SSHAlternative2"]="2222"
["DeathStrandingGaming"]="2703"
["Zwift"]="3022-3025"
["XboxLive"]="3074"
["MySQL"]="3306"
["MoneroMiningPools1"]="3333"
["SteamGaming1"]="3478-3480"
["SVN"]="3690"
["WorldOfWorldcraft2"]="3724"
["WorldOfWorldcraft3"]="4000"
["RWHOIS"]="4321"
["SteamGaming2"]="4379-4380"
["MoneroMiningPools2"]="4444"
["Virtuozzo"]="4643"
["RTPVOIP"]="5000-5005"
["MMCC"]="5050"
["WorldOfWorldcraft8"]="5060-5062"
["ICQ"]="5190"
["XMPP"]="5222-5223"
["AndroidMarket"]="5228"
["PostgreSQL"]="5432"
["WorldOfWorldcraft6"]="6012"
["WorldOfWorldcraft7"]="6112-6120"
["WorldOfWorldcraft9"]="6250"
["WebSocket"]="6300"
["WorldOfWorldcraft4"]="1119-1120"
["WorldOfWorldcraft5"]="8080"
["Electrum"]="8082"
["WorldOfWorldcraft6"]="8085"
["SimplifyMedia"]="8087-8088"
["Zcash"]="8232-8233"
["Bitcoin"]="8332-8333"
["HTTPSALT"]="8443"
["TeamSpeak"]="8767"
["MQTTS"]="8883"
["HTTPProxy"]="8888"
["TorORPort"]="9001"
["TorDirPort"]="9030"
["Tari"]="9053"
["LiteCoinP2P"]="9333"
["Gaming"]="9339"
["Git"]="9418"
["HTTPSALT2"]="9443"
["Lightning"]="9735"
["TeamSpeakVoice"]="9987"
["DashNetwork"]="9999"
["NDMP"]="10000"
["TeamSpeakQuery"]="10011-10080"
["TeamSpeakHTTPS"]="10443"
["OpenPGP"]="11371"
["MoneroMiningPools1"]="14444"
["Monero"]="18080-18081"
["MoneroRPC"]="18089"
["GoogleVoice"]="19294-19344"
["EnsimControlPanel"]="19638"
["Session"]="22021"
["DarkFiTor"]="25551"
["Minecraft"]="25565"
["DarkFi"]="26661"
# ["MongoDBDefault"]="27017" # Within Steam range
["Steam"]="27000-27050"
["WhatsAppRange"]="3478-3484"
["TeamSpeakTSDNS"]="41144"
["DiscordVoiceChat1"]="50000-65535"
# ["ElectrumSSL"]="50002" # Within DiscordVoiceChat1 range
["MOSH"]="60000-61000"
["Mumble"]="64738"
["Metadata"]="51830"
)
local port
for service in "${!PORT_MAPPINGS[@]}"; do
port="${PORT_MAPPINGS[$service]}"
echo "adding rules for $service (ports $port)"
add_port_rules iptables "$port" "tcp"
add_port_rules ip6tables "$port" "tcp"
add_port_rules iptables "$port" "udp"
add_port_rules ip6tables "$port" "udp"
done
}
apply_spamhaus_blocklist() {
info "applying spamhaus-like blocklist from $EXIT_POLICY_LOCATION"
mkdir -p "$(dirname "$POLICY_FILE")"
if ! wget -q "$EXIT_POLICY_LOCATION" -O "$POLICY_FILE" 2>/dev/null; then
error "failed to download exit policy, using minimal blocklist"
cat >"$POLICY_FILE" <<EOF
ExitPolicy reject 5.188.10.0/23:*
ExitPolicy reject 31.132.36.0/22:*
ExitPolicy reject 37.9.42.0/24:*
ExitPolicy reject 45.43.128.0/18:*
ExitPolicy reject *:*
EOF
fi
local tmpfile
tmpfile=$(mktemp)
grep "^ExitPolicy reject" "$POLICY_FILE" | grep -v "\*:\*" > "$tmpfile"
local total_rules
total_rules=$(wc -l < "$tmpfile")
info "processing $total_rules blocklist rules"
local line ip_range
while IFS= read -r line; do
[[ -z "$line" ]] && continue
ip_range=$(echo "$line" | sed -E 's/ExitPolicy reject ([^:]+):.*/\1/')
if [[ -n "$ip_range" ]]; then
# insert blocklist BEFORE the allowlist (after DNS/ICMP bootstrap rules)
# ipv4 reject (DNS/ICMP occupy positions 1-4)
if ! iptables -C "$NYM_CHAIN" -d "$ip_range" -j REJECT --reject-with icmp-port-unreachable 2>/dev/null; then
iptables -I "$NYM_CHAIN" 5 -d "$ip_range" -j REJECT --reject-with icmp-port-unreachable \
|| error "warning: failed adding ipv4 reject for $ip_range"
fi
# ipv6 reject (DNS/ICMP occupy positions 1-3)
if [[ "$ip_range" == *":"* ]]; then
if ! ip6tables -C "$NYM_CHAIN" -d "$ip_range" -j REJECT --reject-with icmp6-port-unreachable 2>/dev/null; then
ip6tables -I "$NYM_CHAIN" 4 -d "$ip_range" -j REJECT --reject-with icmp6-port-unreachable \
|| error "warning: failed adding ipv6 reject for $ip_range"
fi
fi
fi
done < "$tmpfile"
rm -f "$tmpfile"
}
add_default_reject_rule() {
info "ensuring default reject rule at end of ${NYM_CHAIN}"
iptables -D "$NYM_CHAIN" -j REJECT 2>/dev/null || true
iptables -D "$NYM_CHAIN" -j REJECT --reject-with icmp-port-unreachable 2>/dev/null || true
ip6tables -D "$NYM_CHAIN" -j REJECT 2>/dev/null || true
ip6tables -D "$NYM_CHAIN" -j REJECT --reject-with icmp6-port-unreachable 2>/dev/null || true
iptables -A "$NYM_CHAIN" -j REJECT --reject-with icmp-port-unreachable
ip6tables -A "$NYM_CHAIN" -j REJECT --reject-with icmp6-port-unreachable
}
clear_exit_policy_rules() {
info "clearing nym exit policy rules ..."
iptables -F "$NYM_CHAIN" 2>/dev/null || true
ip6tables -F "$NYM_CHAIN" 2>/dev/null || true
# remove hooks for BOTH wg + tun
iptables -D FORWARD -i "$WG_INTERFACE" -o "$NETWORK_DEVICE_V4" -j "$NYM_CHAIN" 2>/dev/null || true
iptables -D FORWARD -i "$TUNNEL_INTERFACE" -o "$NETWORK_DEVICE_V4" -j "$NYM_CHAIN" 2>/dev/null || true
if has_ipv6_uplink; then
ip6tables -D FORWARD -i "$WG_INTERFACE" -o "$NETWORK_DEVICE_V6" -j "$NYM_CHAIN" 2>/dev/null || true
ip6tables -D FORWARD -i "$TUNNEL_INTERFACE" -o "$NETWORK_DEVICE_V6" -j "$NYM_CHAIN" 2>/dev/null || true
fi
iptables -X "$NYM_CHAIN" 2>/dev/null || true
ip6tables -X "$NYM_CHAIN" 2>/dev/null || true
}
show_exit_policy_status() {
info "nym exit policy status"
info "ipv4 network device: $NETWORK_DEVICE_V4"
if has_ipv6_uplink; then
info "ipv6 network device: $NETWORK_DEVICE_V6"
else
warn "ipv6 network device: not detected"
fi
info "wireguard interface: $WG_INTERFACE"
info "tunnel interface: $TUNNEL_INTERFACE"
echo
if ! ip link show "$WG_INTERFACE" >/dev/null 2>&1; then
error "warning: wireguard interface $WG_INTERFACE not found"
else
info "wireguard interface details:"
ip link show "$WG_INTERFACE"
echo
info "wireguard ipv4 addresses:"
ip -4 addr show dev "$WG_INTERFACE"
echo
info "wireguard ipv6 addresses:"
ip -6 addr show dev "$WG_INTERFACE"
fi
echo
if ! ip link show "$TUNNEL_INTERFACE" >/dev/null 2>&1; then
error "warning: tunnel interface $TUNNEL_INTERFACE not found"
else
info "tunnel interface details:"
ip link show "$TUNNEL_INTERFACE"
echo
info "tunnel ipv4 addresses:"
ip -4 addr show dev "$TUNNEL_INTERFACE"
echo
info "tunnel ipv6 addresses:"
ip -6 addr show dev "$TUNNEL_INTERFACE"
fi
echo
info "iptables chains for ${NYM_CHAIN}:"
iptables -L "$NYM_CHAIN" -n -v 2>/dev/null || echo "ipv4 chain not found"
echo
ip6tables -L "$NYM_CHAIN" -n -v 2>/dev/null || echo "ipv6 chain not found"
echo
show_network_firewall_status
echo
info "ip forwarding:"
echo "ipv4: $(cat /proc/sys/net/ipv4/ip_forward 2>/dev/null || echo 0)"
echo "ipv6: $(cat /proc/sys/net/ipv6/conf/all/forwarding 2>/dev/null || echo 0)"
}
test_exit_policy_connectivity() {
info "testing connectivity through $WG_INTERFACE"
local iface_info
iface_info=$(ip link show "$WG_INTERFACE" 2>/dev/null || true)
if [[ -z "$iface_info" ]]; then
error "interface $WG_INTERFACE not found"
return 1
fi
ok "interface:"
ok "$iface_info"
local ipv4_address ipv6_address
ipv4_address=$(ip -4 addr show dev "$WG_INTERFACE" | awk '/inet / {print $2}' | cut -d'/' -f1 | head -n1)
ipv6_address=$(ip -6 addr show dev "$WG_INTERFACE" scope global | awk '/inet6/ {print $2}' | cut -d'/' -f1 | head -n1)
ok "ipv4 address: ${ipv4_address:-none}"
ok "ipv6 address: ${ipv6_address:-none}"
if [[ -n "$ipv4_address" ]]; then
echo -e "${NC}testing ipv4 ping to 8.8.8.8 ..."
timeout 5 ping -c 3 -I "$ipv4_address" 8.8.8.8 >/dev/null 2>&1 && \
ok "ipv4 ping ok" || error "ipv4 ping failed"
echo -e "${NC}testing ipv4 dns resolution ..."
timeout 5 ping -c 3 -I "$ipv4_address" google.com >/dev/null 2>&1 && \
ok "ipv4 dns ok" || error "ipv4 dns failed"
fi
if [[ -n "$ipv6_address" ]]; then
echo -e "${NC}testing ipv6 ping to google dns ..."
timeout 5 ping6 -c 3 -I "$ipv6_address" 2001:4860:4860::8888 >/dev/null 2>&1 && \
ok "ipv6 ping ok" || error "ipv6 ping failed"
echo -e "${NC}testing ipv6 dns resolution ..."
timeout 5 ping6 -c 3 -I "$ipv6_address" google.com >/dev/null 2>&1 && \
ok "ipv6 dns ok" || error "ipv6 dns failed"
fi
ok "connectivity tests finished"
}
###############################################################################
# part 4: check the firewall setup
###############################################################################
firewall_rule_line() {
local chain=$1
local rule_idx=$2
# this is because thefirst rule appears on line 3
iptables -L "$chain" -n --line-numbers | sed -n "$((rule_idx + 2))p"
}
check_forward_chain() {
local errors=0
info "checking FORWARD hooks and reverse RELATED,ESTABLISHED rules"
if iptables -C FORWARD -i "$WG_INTERFACE" -o "$NETWORK_DEVICE_V4" -j "$NYM_CHAIN" 2>/dev/null; then
ok "ipv4 FORWARD hook ok (wg): -i $WG_INTERFACE -o $NETWORK_DEVICE_V4 -> $NYM_CHAIN"
else
error "ipv4 FORWARD hook missing (wg): -i $WG_INTERFACE -o $NETWORK_DEVICE_V4 -> $NYM_CHAIN"
errors=1
fi
if iptables -C FORWARD -i "$TUNNEL_INTERFACE" -o "$NETWORK_DEVICE_V4" -j "$NYM_CHAIN" 2>/dev/null; then
ok "ipv4 FORWARD hook ok (tun): -i $TUNNEL_INTERFACE -o $NETWORK_DEVICE_V4 -> $NYM_CHAIN"
else
error "ipv4 FORWARD hook missing (tun): -i $TUNNEL_INTERFACE -o $NETWORK_DEVICE_V4 -> $NYM_CHAIN"
errors=1
fi
if iptables -C FORWARD -i "$NETWORK_DEVICE_V4" -o "$WG_INTERFACE" -m state --state RELATED,ESTABLISHED -j ACCEPT 2>/dev/null; then
ok "ipv4 reverse RELATED,ESTABLISHED ok (wg): -i $NETWORK_DEVICE_V4 -o $WG_INTERFACE"
else
error "ipv4 reverse RELATED,ESTABLISHED missing (wg): -i $NETWORK_DEVICE_V4 -o $WG_INTERFACE"
errors=1
fi
if iptables -C FORWARD -i "$NETWORK_DEVICE_V4" -o "$TUNNEL_INTERFACE" -m state --state RELATED,ESTABLISHED -j ACCEPT 2>/dev/null; then
ok "ipv4 reverse RELATED,ESTABLISHED ok (tun): -i $NETWORK_DEVICE_V4 -o $TUNNEL_INTERFACE"
else
error "ipv4 reverse RELATED,ESTABLISHED missing (tun): -i $NETWORK_DEVICE_V4 -o $TUNNEL_INTERFACE"
errors=1
fi
if has_ipv6_uplink; then
if ip6tables -C FORWARD -i "$WG_INTERFACE" -o "$NETWORK_DEVICE_V6" -j "$NYM_CHAIN" 2>/dev/null; then
ok "ipv6 FORWARD hook ok (wg): -i $WG_INTERFACE -o $NETWORK_DEVICE_V6 -> $NYM_CHAIN"
else
error "ipv6 FORWARD hook missing (wg): -i $WG_INTERFACE -o $NETWORK_DEVICE_V6 -> $NYM_CHAIN"
errors=1
fi
if ip6tables -C FORWARD -i "$TUNNEL_INTERFACE" -o "$NETWORK_DEVICE_V6" -j "$NYM_CHAIN" 2>/dev/null; then
ok "ipv6 FORWARD hook ok (tun): -i $TUNNEL_INTERFACE -o $NETWORK_DEVICE_V6 -> $NYM_CHAIN"
else
error "ipv6 FORWARD hook missing (tun): -i $TUNNEL_INTERFACE -o $NETWORK_DEVICE_V6 -> $NYM_CHAIN"
errors=1
fi
if ip6tables -C FORWARD -i "$NETWORK_DEVICE_V6" -o "$WG_INTERFACE" -m state --state RELATED,ESTABLISHED -j ACCEPT 2>/dev/null; then
ok "ipv6 reverse RELATED,ESTABLISHED ok (wg): -i $NETWORK_DEVICE_V6 -o $WG_INTERFACE"
else
error "ipv6 reverse RELATED,ESTABLISHED missing (wg): -i $NETWORK_DEVICE_V6 -o $WG_INTERFACE"
errors=1
fi
if ip6tables -C FORWARD -i "$NETWORK_DEVICE_V6" -o "$TUNNEL_INTERFACE" -m state --state RELATED,ESTABLISHED -j ACCEPT 2>/dev/null; then
ok "ipv6 reverse RELATED,ESTABLISHED ok (tun): -i $NETWORK_DEVICE_V6 -o $TUNNEL_INTERFACE"
else
error "ipv6 reverse RELATED,ESTABLISHED missing (tun): -i $NETWORK_DEVICE_V6 -o $TUNNEL_INTERFACE"
errors=1
fi
else
warn "no ipv6 uplink detected; skipping ipv6 FORWARD validation"
fi
return $errors
}
check_nym_exit_chain() {
local errors=0
local patterns=("udp.*dpt:53" "tcp.*dpt:53" "icmp.*type 8" "icmp.*type 0")
for idx in "${!patterns[@]}"; do
local line
line=$(firewall_rule_line "$NYM_CHAIN" $((idx + 1)))
if [[ "$line" =~ ${patterns[$idx]} ]]; then
ok "${NYM_CHAIN} rule $((idx + 1)) ok (${patterns[$idx]})"
else
error "${NYM_CHAIN} rule $((idx + 1)) is not ${patterns[$idx]}; re-run network-tunnel-manager.sh exit_policy_install"
errors=1
fi
done
local last_rule
last_rule=$(iptables -L "$NYM_CHAIN" -n --line-numbers | awk 'NR>2 {line=$0} END {print line}')
if [[ -z "${last_rule:-}" ]]; then
error "${NYM_CHAIN} chain is empty; re-run network-tunnel-manager.sh exit_policy_install"
errors=1
elif [[ "$last_rule" =~ REJECT ]] && [[ "$last_rule" =~ 0\.0\.0\.0/0 ]]; then
ok "${NYM_CHAIN} ends with the catch-all REJECT"
else
error "${NYM_CHAIN} final rule is not the catch-all REJECT (got: $last_rule)"
errors=1
fi
return $errors
}
check_iptables_default_policies() {
info "checking base iptables default policies (INPUT/FORWARD)"
local issues=0
local input_policy forward_policy output_policy
input_policy=$(iptables -S INPUT 2>/dev/null | awk 'NR==1 && $1=="-P" {print $3}')
forward_policy=$(iptables -S FORWARD 2>/dev/null | awk 'NR==1 && $1=="-P" {print $3}')
output_policy=$(iptables -S OUTPUT 2>/dev/null | awk 'NR==1 && $1=="-P" {print $3}')
if [[ -z "${input_policy:-}" ]]; then
error "unable to read INPUT default policy (iptables -S INPUT failed?)"
issues=1
else
info "INPUT default policy is ${input_policy^^}"
fi
if [[ -z "${forward_policy:-}" ]]; then
error "unable to read FORWARD default policy (iptables -S FORWARD failed?)"
issues=1
else
info "FORWARD default policy is ${forward_policy^^}"
fi
if [[ -z "${output_policy:-}" ]]; then
error "unable to read OUTPUT default policy (iptables -S OUTPUT failed?)"
issues=1
elif [[ "${output_policy^^}" != "ACCEPT" ]]; then
error "OUTPUT default policy is ${output_policy^^}; expected ACCEPT"
issues=1
else
ok "OUTPUT default policy is ACCEPT"
fi
return $issues
}
check_firewall_setup() {
info "checking ipv4 firewall ordering…"
local errors=0
check_iptables_default_policies || errors=1
check_forward_chain || errors=1
check_nym_exit_chain || errors=1
test_network_firewall_rules || errors=1
if command -v ip6tables >/dev/null 2>&1; then
info "checking ipv6 firewall ordering…"
if ip6tables -L "$NYM_CHAIN" -n --line-numbers >/dev/null 2>&1; then
if ! ip6tables -L "$NYM_CHAIN" -n --line-numbers | sed -n '3p' | grep -q "udp.*dpt:53"; then
error "ip6tables ${NYM_CHAIN} rule 1 is not UDP 53"
errors=1
fi
fi
fi
if [[ $errors -ne 0 ]]; then
error "There may be some ordering issues, it is recommended to re-run network-tunnel-manager.sh exit_policy_install and review the firewall output above."
return 1
fi
ok "It's looking good!"
return 0
}
###############################################################################
# part 5: full exit policy verification tests
###############################################################################
test_port_range_rules() {
info "testing port range rules in ${NYM_CHAIN}"
local port_ranges=(
"20-21:tcp:ftp"
"80-81:tcp:http"
"2082-2083:tcp:cpanel"
"5222-5223:tcp:xmpp"
"27000-27050:tcp:steam-sample"
"989-990:tcp:ftp-tls"
"5000-5005:tcp:rtp-voip"
"8087-8088:tcp:simplify-media"
"8232-8233:tcp:zcash"
"8332-8333:tcp:bitcoin"
"18080-18081:tcp:monero"
"3478-3484:tcp:whatsapp"
"50000-65535:tcp:discord"
"4379-4380:tcp:steam"
)
local failures=0
local start end
for entry in "${port_ranges[@]}"; do
IFS=':' read -r range proto name <<<"$entry"
start=$(echo "$range" | cut -d'-' -f1)
end=$(echo "$range" | cut -d'-' -f2)
if iptables -t filter -C "$NYM_CHAIN" -p "$proto" --dport "$start:$end" -j ACCEPT 2>/dev/null; then
ok "rule ok: $name $proto $range"
else
error "missing rule: $name $proto $range"
((failures++))
fi
done
return "$failures"
}
test_critical_services() {
info "testing critical service rules in ${NYM_CHAIN}"
local tcp_ports=(22 53 443 853 1194)
local udp_ports=(53 123 1194)
local failures=0
for port in "${tcp_ports[@]}"; do
if iptables -t filter -C "$NYM_CHAIN" -p tcp --dport "$port" -j ACCEPT 2>/dev/null; then
ok "tcp port $port allowed"
else
if iptables-save | grep -E "^-A $NYM_CHAIN.*tcp.*dpts:" | grep -q "$port"; then
ok "tcp port $port allowed by range"
else
error "tcp port $port missing"
((failures++))
fi
fi
done
for port in "${udp_ports[@]}"; do
if iptables -t filter -C "$NYM_CHAIN" -p udp --dport "$port" -j ACCEPT 2>/dev/null; then
ok "udp port $port allowed"
else
if iptables-save | grep -E "^-A $NYM_CHAIN.*udp.*dpts:" | grep -q "$port"; then
ok "udp port $port allowed by range"
else
error "udp port $port missing"
((failures++))
fi
fi
done
return "$failures"
}
test_forward_chain_hook() {
info "testing forward chain hook direction for ${NYM_CHAIN}"
local failures=0
# verify BOTH interfaces are hooked to NYM-EXIT for IPv4
if iptables -C FORWARD -i "$WG_INTERFACE" -o "$NETWORK_DEVICE_V4" -j "$NYM_CHAIN" 2>/dev/null; then
ok "ipv4 forward hook ok (wg): -i $WG_INTERFACE -o $NETWORK_DEVICE_V4 -> $NYM_CHAIN"
else
error "ipv4 forward hook missing or wrong (wg)"
((failures++))
fi
if iptables -C FORWARD -i "$TUNNEL_INTERFACE" -o "$NETWORK_DEVICE_V4" -j "$NYM_CHAIN" 2>/dev/null; then
ok "ipv4 forward hook ok (tun): -i $TUNNEL_INTERFACE -o $NETWORK_DEVICE_V4 -> $NYM_CHAIN"
else
error "ipv4 forward hook missing or wrong (tun)"
((failures++))
fi
if has_ipv6_uplink; then
if ip6tables -C FORWARD -i "$WG_INTERFACE" -o "$NETWORK_DEVICE_V6" -j "$NYM_CHAIN" 2>/dev/null; then
ok "ipv6 forward hook ok (wg): -i $WG_INTERFACE -o $NETWORK_DEVICE_V6 -> $NYM_CHAIN"
else
error "ipv6 forward hook missing or wrong (wg)"
((failures++))
fi
if ip6tables -C FORWARD -i "$TUNNEL_INTERFACE" -o "$NETWORK_DEVICE_V6" -j "$NYM_CHAIN" 2>/dev/null; then
ok "ipv6 forward hook ok (tun): -i $TUNNEL_INTERFACE -o $NETWORK_DEVICE_V6 -> $NYM_CHAIN"
else
error "ipv6 forward hook missing or wrong (tun)"
((failures++))
fi
else
warn "no ipv6 uplink detected; skipping ipv6 forward hook tests"
fi
return "$failures"
}
test_default_reject_rule() {
info "testing default reject rule position in ${NYM_CHAIN}"
local last_rule_v4
last_rule_v4=$(iptables -S "$NYM_CHAIN" | awk '/^-A /{rule=$0} END{print rule}')
if [[ "$last_rule_v4" != "-A $NYM_CHAIN -j REJECT --reject-with icmp-port-unreachable" ]]; then
error "default reject missing or not last in ipv4 chain"
return 1
fi
local last_rule_v6
last_rule_v6=$(ip6tables -S "$NYM_CHAIN" | awk '/^-A /{rule=$0} END{print rule}')
if [[ "$last_rule_v6" != "-A $NYM_CHAIN -j REJECT --reject-with icmp6-port-unreachable" ]]; then
error "default reject missing or not last in ipv6 chain"
return 1
fi
ok "default reject confirmed at end of ${NYM_CHAIN}"
}
exit_policy_run_tests() {
local skip_default=0
while [[ $# -gt 0 ]]; do
case "$1" in
--skip-default-reject) skip_default=1; shift ;;
*) error "unknown test option: $1"; return 1 ;;
esac
done
local total=0
local failed=0
test_forward_chain_hook || ((failed += 1))
((total += 1))
test_port_range_rules || ((failed += 1))
((total += 1))
test_critical_services || ((failed += 1))
((total += 1))
test_network_firewall_rules || ((failed += 1))
((total += 1))
if [[ $skip_default -eq 0 ]]; then
test_default_reject_rule || ((failed += 1))
((total += 1))
fi
info "tests run: ${GREEN}$total${YELLOW}, test failed: ${RED}$failed${NC}"
if [[ $failed -eq 0 ]]; then
ok "all exit policy tests passed"
else
error "some exit policy tests failed"
fi
return "$failed"
}
###############################################################################
# part 6: high level workflows
###############################################################################
nym_tunnel_setup() {
info "running full tunnel setup for ${TUNNEL_INTERFACE} and ${WG_INTERFACE}"
check_tunnel_iptables "$TUNNEL_INTERFACE"
remove_duplicate_rules "$TUNNEL_INTERFACE"
remove_duplicate_rules "$WG_INTERFACE"
check_tunnel_iptables "$TUNNEL_INTERFACE"
adjust_ip_forwarding
apply_iptables_rules "$TUNNEL_INTERFACE"
check_tunnel_iptables "$TUNNEL_INTERFACE"
apply_iptables_rules "$WG_INTERFACE"
configure_dns_and_icmp_wg
adjust_ip_forwarding
check_ipv6_ipv4_forwarding
joke_through_tunnel "$TUNNEL_INTERFACE"
joke_through_tunnel "$WG_INTERFACE"
ok "full tunnel setup completed"
}
exit_policy_install() {
info "installing nym wireguard exit policy for ${WG_INTERFACE} via ipv4 uplink ${NETWORK_DEVICE_V4}${NETWORK_DEVICE_V6:+ and ipv6 uplink ${NETWORK_DEVICE_V6}}"
exit_policy_install_deps
adjust_ip_forwarding
create_nym_chain
setup_nat_rules
apply_port_allowlist
apply_smtps_465_rate_limit
apply_spamhaus_blocklist
add_default_reject_rule
save_iptables_rules
ok "nym exit policy installed"
}
complete_networking_configuration() {
info "starting complete networking configuration: tunnels + host firewall + exit policy"
nym_tunnel_setup
configure_network_firewall
exit_policy_install
check_firewall_setup || error "firewall order checks reported problems, please review output"
exit_policy_run_tests || error "exit policy tests reported problems, please review output"
ok "complete networking configuration finished"
}
###############################################################################
# cli
###############################################################################
cmd="${1:-help}"
log "COMMAND: $cmd ARGS: $*"
case "$cmd" in
nym_tunnel_setup)
nym_tunnel_setup
status=$?
;;
exit_policy_install)
exit_policy_install
status=$?
;;
complete_networking_configuration)
complete_networking_configuration
status=$?
;;
# nym firewall setup
configure_network_firewall)
configure_network_firewall
status=$?
;;
# tunnel manager cmds
fetch_ipv6_address_nym_tun)
fetch_ipv6_address "$TUNNEL_INTERFACE"
status=$?
;;
fetch_and_display_ipv6)
fetch_and_display_ipv6
status=$?
;;
apply_iptables_rules)
apply_iptables_rules "$TUNNEL_INTERFACE"
status=$?
;;
apply_iptables_rules_wg)
apply_iptables_rules "$WG_INTERFACE"
status=$?
;;
check_nymtun_iptables)
check_tunnel_iptables "$TUNNEL_INTERFACE"
status=$?
;;
check_nym_wg_tun)
check_tunnel_iptables "$WG_INTERFACE"
status=$?
;;
check_ipv6_ipv4_forwarding)
check_ipv6_ipv4_forwarding
status=$?
;;
check_ip_routing)
check_ip_routing
status=$?
;;
perform_pings)
perform_pings
status=$?
;;
joke_through_the_mixnet)
joke_through_tunnel "$TUNNEL_INTERFACE"
status=$?
;;
joke_through_wg_tunnel)
joke_through_tunnel "$WG_INTERFACE"
status=$?
;;
configure_dns_and_icmp_wg)
configure_dns_and_icmp_wg
status=$?
;;
adjust_ip_forwarding)
adjust_ip_forwarding
status=$?
;;
remove_duplicate_rules)
remove_duplicate_rules "${2:-}"
status=$?
;;
# exit policy manager cmds
exit_policy_status)
show_exit_policy_status
status=$?
;;
check_firewall_setup)
check_firewall_setup
status=$?
;;
exit_policy_test_connectivity)
test_exit_policy_connectivity
status=$?
;;
exit_policy_clear)
clear_exit_policy_rules
status=$?
;;
exit_policy_tests)
shift
exit_policy_run_tests "$@"
status=$?
;;
help|--help|-h)
cat <<EOF
usage: $0 <command> [args]
high level workflows:
complete_networking_configuration Install tunnel interfaces, setup networking, host firewall, iptables, wg exit policy & tests
nym_tunnel_setup Install tunnel interfaces & setup networking
configure_network_firewall Install host firewall rules for nym services
exit_policy_install Install and configure wireguard exit policy
tunnel and nat helpers:
adjust_ip_forwarding Enable ipv4/ipv6 forwarding via sysctl.d
apply_iptables_rules Apply nat/forward rules for ${TUNNEL_INTERFACE}
apply_iptables_rules_wg Apply nat/forward rules for ${WG_INTERFACE}
check_ip_routing Show ipv4 and ipv6 routes
check_ipv6_ipv4_forwarding Show ipv4/ipv6 forwarding flags
check_nym_wg_tun Inspect forward chain for ${WG_INTERFACE}
check_nymtun_iptables Inspect forward chain for ${TUNNEL_INTERFACE}
configure_dns_and_icmp_wg Allow ping and dns ports on this host
fetch_and_display_ipv6 Show ipv6 on uplink ${NETWORK_DEVICE_V6:-<none>}
fetch_ipv6_address_nym_tun Show global ipv6 address on ${TUNNEL_INTERFACE}
joke_through_the_mixnet Test via ${TUNNEL_INTERFACE} with joke
joke_through_wg_tunnel Test via ${WG_INTERFACE} with joke
perform_pings Test ipv4 and ipv6 pings
remove_duplicate_rules <iface> Deduplicate FORWARD and ${NYM_CHAIN} rules for <iface> (required).
exit policy manager:
check_firewall_setup Run ordering sanity check (dns/icmp + FORWARD jump)
exit_policy_clear Remove ${NYM_CHAIN} chains and hooks
exit_policy_install Install exit policy (iptables rules and blocklist)
exit_policy_status Show status of exit policy and forwarding
exit_policy_test_connectivity Test connectivity via ${WG_INTERFACE}
exit_policy_tests [--skip-default-reject]
Run verification tests on exit policy (options: --skip-default-reject).
environment overrides:
NETWORK_DEVICE Backward-compatible override that sets both uplinks.
NETWORK_DEVICE_V4 Auto-detected IPv4 uplink (e.g., eth0). Set manually if detection fails.
NETWORK_DEVICE_V6 Auto-detected IPv6 uplink (e.g., eth2). Optional; if unset, IPv6-specific setup is skipped.
TUNNEL_INTERFACE Default: nymtun0. Requires root privileges (sudo) to manage.
WG_INTERFACE Default: nymwg - Must match your WireGuard interface name.
HOST_SSH_PORT Default: 22. Set manually if you connect to your host's SSH daemon through another port.
EOF
status=0
;;
*)
error "unknown command: $cmd"
info "run with 'help' for usage"
exit 1
;;
esac
if [[ "$cmd" != help && "$cmd" != "--help" && "$cmd" != "-h" && ${status:-1} -eq 0 ]]; then
echo ""
echo "Logs saved locally at: $LOG_FILE"
ok "operation ${cmd} completed"
fi
END_TIME=$(date +%s)
ELAPSED=$((END_TIME - START_TIME))
echo "----- $(date '+%Y-%m-%d %H:%M:%S') END operation ${cmd} (status $status, duration ${ELAPSED}s) -----" >> "$LOG_FILE"
exit $status
Reference in New Issue View Git Blame Copy Permalink