pedrofaustino
291 lines
11 KiB
Bash
291 lines
11 KiB
Bash
#!/bin/bash
|
|
|
|
network_device=$(ip route show default | awk '/default/ {print $5}')
|
|
tunnel_interface="nymtun0"
|
|
wg_tunnel_interface="nymwg"
|
|
|
|
if ! dpkg -s iptables-persistent >/dev/null 2>&1; then
|
|
sudo apt-get update
|
|
sudo apt-get install -y iptables-persistent
|
|
else
|
|
echo "iptables-persistent is already installed."
|
|
fi
|
|
|
|
fetch_ipv6_address() {
|
|
local interface=$1
|
|
ipv6_global_address=$(ip -6 addr show "$interface" scope global | grep inet6 | awk '{print $2}' | head -n 1)
|
|
|
|
if [[ -z "$ipv6_global_address" ]]; then
|
|
echo "no globally routable IPv6 address found on $interface. Please configure IPv6 or check your network settings."
|
|
exit 1
|
|
else
|
|
echo "using IPv6 address: $ipv6_global_address"
|
|
fi
|
|
}
|
|
|
|
fetch_and_display_ipv6() {
|
|
ipv6_address=$(ip -6 addr show "$network_device" scope global | grep inet6 | awk '{print $2}')
|
|
if [[ -z "$ipv6_address" ]]; then
|
|
echo "no global IPv6 address found on $network_device."
|
|
else
|
|
echo "IPv6 address on $network_device: $ipv6_address"
|
|
fi
|
|
}
|
|
|
|
remove_duplicate_rules() {
|
|
local interface=$1
|
|
local script_name=$(basename "$0")
|
|
|
|
if [[ -z "$interface" ]]; then
|
|
echo "error: no interface specified. please enter the interface (nymwg or nymtun0):"
|
|
read -r interface
|
|
fi
|
|
|
|
if [[ "$interface" != "nymwg" && "$interface" != "nymtun0" ]]; then
|
|
echo "error: invalid interface '$interface'. allowed values are 'nymwg' or 'nymtun0'." >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "removing duplicate rules for $interface..."
|
|
|
|
iptables-save | grep "$interface" | while read -r line; do
|
|
sudo iptables -D ${line#-A } || echo "Failed to delete rule: $line"
|
|
done
|
|
|
|
ip6tables-save | grep "$interface" | while read -r line; do
|
|
sudo ip6tables -D ${line#-A } || echo "Failed to delete rule: $line"
|
|
done
|
|
|
|
echo "duplicates removed for $interface."
|
|
echo "!!-important-!! you need to now reapply the iptables rules for $interface."
|
|
if [ "$interface" == "nymwg" ]; then
|
|
echo "run: ./$script_name apply_iptables_rules_wg"
|
|
else
|
|
echo "run: ./$script_name apply_iptables_rules"
|
|
fi
|
|
}
|
|
|
|
adjust_ip_forwarding() {
|
|
ipv6_forwarding_setting="net.ipv6.conf.all.forwarding=1"
|
|
ipv4_forwarding_setting="net.ipv4.ip_forward=1"
|
|
|
|
# remove duplicate entries for these settings from the file
|
|
sudo sed -i "/^net.ipv6.conf.all.forwarding=/d" /etc/sysctl.conf
|
|
sudo sed -i "/^net.ipv4.ip_forward=/d" /etc/sysctl.conf
|
|
|
|
echo "$ipv6_forwarding_setting" | sudo tee -a /etc/sysctl.conf
|
|
echo "$ipv4_forwarding_setting" | sudo tee -a /etc/sysctl.conf
|
|
|
|
sudo sysctl -p /etc/sysctl.conf
|
|
|
|
}
|
|
|
|
apply_iptables_rules() {
|
|
local interface=$1
|
|
echo "applying IPtables rules for $interface..."
|
|
sleep 2
|
|
|
|
sudo iptables -t nat -A POSTROUTING -o "$network_device" -j MASQUERADE
|
|
sudo iptables -A FORWARD -i "$interface" -o "$network_device" -j ACCEPT
|
|
sudo iptables -A FORWARD -i "$network_device" -o "$interface" -m state --state RELATED,ESTABLISHED -j ACCEPT
|
|
|
|
sudo ip6tables -t nat -A POSTROUTING -o "$network_device" -j MASQUERADE
|
|
sudo ip6tables -A FORWARD -i "$interface" -o "$network_device" -j ACCEPT
|
|
sudo ip6tables -A FORWARD -i "$network_device" -o "$interface" -m state --state RELATED,ESTABLISHED -j ACCEPT
|
|
|
|
sudo iptables-save | sudo tee /etc/iptables/rules.v4
|
|
sudo ip6tables-save | sudo tee /etc/iptables/rules.v6
|
|
}
|
|
|
|
check_tunnel_iptables() {
|
|
local interface=$1
|
|
echo "inspecting IPtables rules for $interface..."
|
|
echo "---------------------------------------"
|
|
echo "IPv4 rules:"
|
|
iptables -L FORWARD -v -n | awk -v dev="$interface" '/^Chain FORWARD/ || $0 ~ dev || $0 ~ "ufw-reject-forward"'
|
|
echo "---------------------------------------"
|
|
echo "IPv6 rules:"
|
|
ip6tables -L FORWARD -v -n | awk -v dev="$interface" '/^Chain FORWARD/ || $0 ~ dev || $0 ~ "ufw6-reject-forward"'
|
|
}
|
|
|
|
check_ipv6_ipv4_forwarding() {
|
|
result_ipv4=$(cat /proc/sys/net/ipv4/ip_forward)
|
|
result_ipv6=$(cat /proc/sys/net/ipv6/conf/all/forwarding)
|
|
echo "IPv4 forwarding is $([ "$result_ipv4" == "1" ] && echo "enabled" || echo "not enabled")."
|
|
echo "IPv6 forwarding is $([ "$result_ipv6" == "1" ] && echo "enabled" || echo "not enabled")."
|
|
}
|
|
|
|
check_ip_routing() {
|
|
echo "IPv4 routing table:"
|
|
ip route
|
|
echo "---------------------------------------"
|
|
echo "IPv6 routing table:"
|
|
ip -6 route
|
|
}
|
|
|
|
perform_pings() {
|
|
echo "performing IPv4 ping to google.com..."
|
|
ping -c 4 google.com
|
|
echo "---------------------------------------"
|
|
echo "performing IPv6 ping to google.com..."
|
|
ping6 -c 4 google.com
|
|
}
|
|
|
|
joke_through_tunnel() {
|
|
local interface=$1
|
|
local green="\033[0;32m"
|
|
local reset="\033[0m"
|
|
local red="\033[0;31m"
|
|
local yellow="\033[0;33m"
|
|
|
|
sleep 1
|
|
echo
|
|
echo -e "${yellow}checking tunnel connectivity and fetching a joke for $interface...${reset}"
|
|
echo -e "${yellow}if these test succeeds, it confirms your machine can reach the outside world via IPv4 and IPv6.${reset}"
|
|
echo -e "${yellow}however, probes and external clients may experience different connectivity to your nym-node.${reset}"
|
|
|
|
ipv4_address=$(ip addr show "$interface" | awk '/inet / {print $2}' | cut -d'/' -f1)
|
|
ipv6_address=$(ip addr show "$interface" | awk '/inet6 / && $2 !~ /^fe80/ {print $2}' | cut -d'/' -f1)
|
|
|
|
if [[ -z "$ipv4_address" && -z "$ipv6_address" ]]; then
|
|
echo -e "${red}no IP address found on $interface. unable to fetch a joke.${reset}"
|
|
echo -e "${red}please verify your tunnel configuration and ensure the interface is up.${reset}"
|
|
return 1
|
|
fi
|
|
|
|
if [[ -n "$ipv4_address" ]]; then
|
|
echo
|
|
echo -e "------------------------------------"
|
|
echo -e "detected IPv4 address: $ipv4_address"
|
|
echo -e "testing IPv4 connectivity..."
|
|
echo
|
|
|
|
if ping -c 1 -I "$ipv4_address" google.com >/dev/null 2>&1; then
|
|
echo -e "${green}IPv4 connectivity is working. fetching a joke...${reset}"
|
|
joke=$(curl -s -H "Accept: application/json" --interface "$ipv4_address" https://icanhazdadjoke.com/ | jq -r .joke)
|
|
[[ -n "$joke" && "$joke" != "null" ]] && echo -e "${green}IPv4 joke: $joke${reset}" || echo -e "failed to fetch a joke via IPv4."
|
|
else
|
|
echo -e "${red}IPv4 connectivity is not working for $interface. verify your routing and NAT settings.${reset}"
|
|
fi
|
|
else
|
|
echo -e "${red}no IPv4 address found on $interface. unable to fetch a joke via IPv4.${reset}"
|
|
fi
|
|
|
|
if [[ -n "$ipv6_address" ]]; then
|
|
echo
|
|
echo -e "------------------------------------"
|
|
echo -e "detected IPv6 address: $ipv6_address"
|
|
echo -e "testing IPv6 connectivity..."
|
|
echo
|
|
|
|
if ping6 -c 1 -I "$ipv6_address" google.com >/dev/null 2>&1; then
|
|
echo -e "${green}IPv6 connectivity is working. fetching a joke...${reset}"
|
|
joke=$(curl -s -H "Accept: application/json" --interface "$ipv6_address" https://icanhazdadjoke.com/ | jq -r .joke)
|
|
[[ -n "$joke" && "$joke" != "null" ]] && echo -e "${green}IPv6 joke: $joke${reset}" || echo -e "${red}failed to fetch a joke via IPv6.${reset}"
|
|
else
|
|
echo -e "${red}IPv6 connectivity is not working for $interface. verify your routing and NAT settings.${reset}"
|
|
fi
|
|
else
|
|
echo -e "${red}no IPv6 address found on $interface. unable to fetch a joke via IPv6.${reset}"
|
|
fi
|
|
|
|
echo -e "${green}joke fetching processes completed for $interface.${reset}"
|
|
echo -e "------------------------------------"
|
|
|
|
sleep 3
|
|
echo
|
|
echo
|
|
echo -e "${yellow}### connectivity testing recommendations ###${reset}"
|
|
echo -e "${yellow}- use the following command to test WebSocket connectivity from an external client:${reset}"
|
|
echo -e "${yellow} wscat -c wss://<your-ip-address/ hostname>:9001 ${reset}"
|
|
echo -e "${yellow}- test UDP connectivity on port 51822 (commonly used for nym wireguard) ${reset}"
|
|
echo -e "${yellow} from another machine, use tools like nc or socat to send UDP packets ${reset}"
|
|
echo -e "${yellow} echo 'test message' | nc -u <your-ip-address> 51822 ${reset}"
|
|
echo -e "${yellow}if connectivity issues persist, ensure port forwarding and firewall rules are correctly configured ${reset}"
|
|
echo
|
|
}
|
|
|
|
|
|
configure_dns_and_icmp_wg() {
|
|
echo "allowing icmp (ping)..."
|
|
sudo iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
|
|
sudo iptables -A OUTPUT -p icmp --icmp-type echo-reply -j ACCEPT
|
|
|
|
echo "allowing dns over udp (port 53)..."
|
|
sudo iptables -A INPUT -p udp --dport 53 -j ACCEPT
|
|
|
|
echo "allowing dns over tcp (port 53)..."
|
|
sudo iptables -A INPUT -p tcp --dport 53 -j ACCEPT
|
|
|
|
echo "saving iptables rules..."
|
|
sudo iptables-save >/etc/iptables/rules.v4
|
|
|
|
echo "dns and icmp configuration completed."
|
|
}
|
|
|
|
case "$1" in
|
|
fetch_ipv6_address_nym_tun)
|
|
fetch_ipv6_address "$tunnel_interface"
|
|
;;
|
|
fetch_and_display_ipv6)
|
|
fetch_and_display_ipv6
|
|
;;
|
|
apply_iptables_rules)
|
|
apply_iptables_rules "$tunnel_interface"
|
|
;;
|
|
apply_iptables_rules_wg)
|
|
apply_iptables_rules "$wg_tunnel_interface"
|
|
;;
|
|
check_nymtun_iptables)
|
|
check_tunnel_iptables "$tunnel_interface"
|
|
;;
|
|
check_nym_wg_tun)
|
|
check_tunnel_iptables "$wg_tunnel_interface"
|
|
;;
|
|
check_ipv6_ipv4_forwarding)
|
|
check_ipv6_ipv4_forwarding
|
|
;;
|
|
check_ip_routing)
|
|
check_ip_routing
|
|
;;
|
|
perform_pings)
|
|
perform_pings
|
|
;;
|
|
joke_through_the_mixnet)
|
|
joke_through_tunnel "$tunnel_interface"
|
|
;;
|
|
joke_through_wg_tunnel)
|
|
joke_through_tunnel "$wg_tunnel_interface"
|
|
;;
|
|
configure_dns_and_icmp_wg)
|
|
configure_dns_and_icmp_wg
|
|
;;
|
|
adjust_ip_forwarding)
|
|
adjust_ip_forwarding
|
|
;;
|
|
remove_duplicate_rules)
|
|
remove_duplicate_rules "$2"
|
|
;;
|
|
*)
|
|
echo "Usage: $0 [command]"
|
|
echo "Commands:"
|
|
echo " fetch_ipv6_address_nym_tun - Fetch IPv6 for nymtun0."
|
|
echo " fetch_and_display_ipv6 - Show IPv6 on default device."
|
|
echo " apply_iptables_rules - Apply IPtables rules for nymtun0."
|
|
echo " apply_iptables_rules_wg - Apply IPtables rules for nymwg."
|
|
echo " check_nymtun_iptables - Check IPtables for nymtun0."
|
|
echo " check_nym_wg_tun - Check IPtables for nymwg."
|
|
echo " check_ipv6_ipv4_forwarding - Check IPv4 and IPv6 forwarding."
|
|
echo " check_ip_routing - Display IP routing tables."
|
|
echo " perform_pings - Test IPv4 and IPv6 connectivity."
|
|
echo " joke_through_the_mixnet - Fetch a joke via nymtun0."
|
|
echo " joke_through_wg_tunnel - Fetch a joke via nymwg."
|
|
echo " configure_dns_and_icmp_wg - Allows icmp ping tests for probes alongside configuring dns"
|
|
echo " adjust_ip_forwarding - Enable IPV6 and IPV4 forwarding"
|
|
echo " remove_duplicate_rules <interface> - Remove duplicate iptables rules. Valid interfaces: nymwg, nymtun0"
|
|
exit 1
|
|
;;
|
|
esac
|
|
|
|
echo "operation $1 completed successfully."
|