52 lines
2.1 KiB
Shell
52 lines
2.1 KiB
Shell
|
#!/bin/sh
|
||
|
|
# The rules around the tunnel to Jellyfin at home (ADR 0032, D5), set by wg-quick as
|
||
|
|
# the tunnel comes up and taken away as it goes (wg-jellyfin.conf), so they live
|
||
|
|
# exactly as long as it: `wg-jellyfin-rules.sh up|down <interface>`. As
|
||
|
|
# /etc/wireguard/wg-jellyfin-rules.sh on the instance's server (root, 0700).
|
||
|
|
#
|
||
|
|
# - Forwarded (Docker's DOCKER-USER, before Docker's own rules): into the tunnel only
|
||
|
|
# Caddy (172.30.80.2, its fixed address on edge) to Jellyfin (10.61.96.2:8096), out
|
||
|
|
# of it only the replies; everything else dropped. Docker then masquerades Caddy's
|
||
|
|
# requests as the tunnel's 10.61.96.1, which the home end sees as its proxy.
|
||
|
|
# - To the host itself (INPUT): only replies from the tunnel, so the home end reaches
|
||
|
|
# neither sshd nor anything else listening here.
|
||
|
|
#
|
||
|
|
# IPv4 alone: the tunnel carries no IPv6 (D3). Needs Docker's chains, so the tunnel
|
||
|
|
# starts after Docker (wg-quick-after-docker.conf).
|
||
|
|
|
||
|
|
set -eu
|
||
|
|
|
||
|
|
action=$1
|
||
|
|
interface=$2
|
||
|
|
forward=halkyon-jellyfin-forward
|
||
|
|
input=halkyon-jellyfin-input
|
||
|
|
|
||
|
|
case "$action" in
|
||
|
|
up)
|
||
|
|
iptables -N "$forward"
|
||
|
|
iptables -A "$forward" -i "$interface" -m conntrack --ctstate ESTABLISHED,RELATED -j RETURN
|
||
|
|
iptables -A "$forward" -o "$interface" -s 172.30.80.2 -d 10.61.96.2 -p tcp --dport 8096 -j RETURN
|
||
|
|
iptables -A "$forward" -j DROP
|
||
|
|
iptables -I DOCKER-USER -i "$interface" -j "$forward"
|
||
|
|
iptables -I DOCKER-USER -o "$interface" -j "$forward"
|
||
|
|
|
||
|
|
iptables -N "$input"
|
||
|
|
iptables -A "$input" -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
|
||
|
|
iptables -A "$input" -j DROP
|
||
|
|
iptables -I INPUT -i "$interface" -j "$input"
|
||
|
|
;;
|
||
|
|
down)
|
||
|
|
# Whatever is there of it, so a half-made set goes too.
|
||
|
|
iptables -D DOCKER-USER -i "$interface" -j "$forward" 2>/dev/null || true
|
||
|
|
iptables -D DOCKER-USER -o "$interface" -j "$forward" 2>/dev/null || true
|
||
|
|
iptables -F "$forward" 2>/dev/null || true
|
||
|
|
iptables -X "$forward" 2>/dev/null || true
|
||
|
|
iptables -D INPUT -i "$interface" -j "$input" 2>/dev/null || true
|
||
|
|
iptables -F "$input" 2>/dev/null || true
|
||
|
|
iptables -X "$input" 2>/dev/null || true
|
||
|
|
;;
|
||
|
|
*)
|
||
|
|
echo "usage: $0 up|down <interface>" >&2
|
||
|
|
exit 2
|
||
|
|
;;
|
||
|
|
esac
|