Fix error handling bridge devices on host systems.
This commit is contained in:
@@ -70,33 +70,6 @@ if ! "$ipt" --version 2>/dev/null | grep -q "nf_tables"; then
|
||||
fi
|
||||
|
||||
|
||||
# - Check if running inside a container
|
||||
# -
|
||||
host_is_vm=false
|
||||
|
||||
# - If running in a LXC container 'cat /proc/1/environ | tr '\0' '\n' | grep ^container | grep lxc'
|
||||
# - returns "container=lxc"
|
||||
# -
|
||||
r_val="$(cat /proc/1/environ | tr '\0' '\n' | grep ^container | grep lxc)"
|
||||
if [[ -n "$r_val" ]] ; then
|
||||
host_is_vm=true
|
||||
else
|
||||
|
||||
# ---
|
||||
# - For other container types we need a few more tricks
|
||||
# ---
|
||||
|
||||
# Detect old-style libvirt
|
||||
[ -n "$LIBVIRT_LXC_UUID" ] && host_is_vm=true
|
||||
|
||||
# Detect vserver
|
||||
if ! $host_is_vm ; then
|
||||
VXID="$(cat /proc/self/status | grep ^VxID | cut -f2)" || true
|
||||
[ "${VXID:-0}" -gt 1 ] && host_is_vm=true
|
||||
fi
|
||||
fi
|
||||
|
||||
|
||||
# -------------
|
||||
# --- Ensure required modules for this script (best effort; host-side in containers)
|
||||
# -------------
|
||||
@@ -106,24 +79,25 @@ echononl "\tEnsure required modules are loaded.."
|
||||
if is_container ; then
|
||||
echo_skipped
|
||||
else
|
||||
|
||||
ensure_mod nf_conntrack
|
||||
ensure_mod nf_nat
|
||||
ensure_mod nf_conntrack_ftp
|
||||
ensure_mod nf_nat_ftp
|
||||
ensure_mod xt_recent
|
||||
ensure_mod xt_hashlimit
|
||||
ensure_mod xt_connlimit
|
||||
ensure_mod xt_owner
|
||||
ensure_mod xt_helper
|
||||
ensure_mod br_netfilter
|
||||
|
||||
echo_done
|
||||
fi
|
||||
|
||||
ensure_mod nf_conntrack
|
||||
ensure_mod nf_nat
|
||||
ensure_mod nf_conntrack_ftp
|
||||
ensure_mod nf_nat_ftp
|
||||
ensure_mod xt_recent
|
||||
ensure_mod xt_hashlimit
|
||||
ensure_mod xt_connlimit
|
||||
ensure_mod xt_owner
|
||||
ensure_mod xt_helper
|
||||
ensure_mod br_netfilter
|
||||
|
||||
|
||||
# --- Security hardening / predictable conntrack behavior:
|
||||
# Disable automatic conntrack helper assignment (keep explicit CT --helper rules)
|
||||
if ! $host_is_vm ; then
|
||||
if ! is_container ; then
|
||||
sysctl -w net.netfilter.nf_conntrack_helper=0 >/dev/null 2>&1 || true
|
||||
fi
|
||||
|
||||
@@ -201,7 +175,7 @@ fi
|
||||
echo ""
|
||||
echononl "\tAdjust Kernel Parameters (Security/Tuning).."
|
||||
|
||||
if ! $host_is_vm ; then
|
||||
if ! is_container ; then
|
||||
## - Reduce DoS'ing ability by reducing timeouts
|
||||
## -
|
||||
if $kernel_reduce_timeouts ; then
|
||||
@@ -271,6 +245,78 @@ else
|
||||
fi
|
||||
|
||||
|
||||
# -------------
|
||||
# --- Prevent bridged traffic getting pushed through the host's iptables rules
|
||||
# -------------
|
||||
|
||||
echo
|
||||
echononl "\tDo not firewall bridged / LX Gust System traffic"
|
||||
|
||||
if ${do_not_firewall_bridged_traffic} || ${do_not_firewall_lx_guest_systems} ; then
|
||||
|
||||
if ! is_container; then
|
||||
|
||||
_done=false
|
||||
|
||||
for _dev in ${ext_if_arr[@]} ; do
|
||||
|
||||
# Try to detect virtual interfaces (veth*)) and the master interface
|
||||
# of the given bridge dynamically
|
||||
#
|
||||
# ports="$(get_bridge_ports "$br")"
|
||||
#
|
||||
# or directly here:
|
||||
#
|
||||
# ports="$(ip -o link show master "${_dev}" 2>/dev/null | awk -F': ' '{print $2}')"
|
||||
#
|
||||
# ports="$(ip -o link show master "${_dev}" 2>/dev/null | awk -F': ' '{print $2}')"
|
||||
#
|
||||
ports="$(ip -o link show master "${_dev}" 2>/dev/null | awk -F': ' '{print $2}')"
|
||||
|
||||
for _port in $ports ; do
|
||||
$ipt -A FORWARD -i "${_port}" -j ACCEPT
|
||||
$ipt -A FORWARD -o "${_port}" -j ACCEPT
|
||||
_done=true
|
||||
done
|
||||
|
||||
done
|
||||
|
||||
if ! ${_done} ; then
|
||||
$ipt -A FORWARD -i veth+ -j ACCEPT
|
||||
$ipt -A FORWARD -o veth+ -j ACCEPT
|
||||
fi
|
||||
|
||||
echo_done
|
||||
else
|
||||
echo_skipped
|
||||
fi
|
||||
else
|
||||
echo_skipped
|
||||
fi
|
||||
|
||||
|
||||
echononl "\tIPv4: bypass host filtering for container ports.."
|
||||
if ${do_not_firewall_bridged_traffic} || ${do_not_firewall_lx_guest_systems} ; then
|
||||
|
||||
if ! is_container; then
|
||||
|
||||
_bridge_sysctl_ok=true
|
||||
|
||||
# IPv4: if you keep the sysctl bypass (recommended if it's working)
|
||||
sysctl -w net.bridge.bridge-nf-call-iptables=0 >/dev/null 2>&1 || _bridge_sysctl_ok=false
|
||||
|
||||
if ${_bridge_sysctl_ok} ; then
|
||||
echo_done
|
||||
else
|
||||
echo_failed
|
||||
fi
|
||||
|
||||
else
|
||||
echo_skipped
|
||||
fi
|
||||
fi
|
||||
|
||||
|
||||
# ------------- Fail2ban handling (do not stop/start; keep bans stable) -------------
|
||||
echo
|
||||
echononl "\tCheck presence and configuration of Fail2ban .."
|
||||
@@ -339,65 +385,6 @@ echo
|
||||
|
||||
|
||||
|
||||
# -------------
|
||||
# --- Prevent bridged traffic getting pushed through the host's iptables rules
|
||||
# -------------
|
||||
|
||||
echononl "\tDo not firewall bridged traffic"
|
||||
if $do_not_firewall_bridged_traffic ; then
|
||||
|
||||
# Debian 12/13 (iptables-nft): Prefer disabling bridge netfilter hooks via sysctl
|
||||
# instead of relying on xt_physdev matches. This avoids backend/bridge quirks and
|
||||
# keeps bridged L2 traffic out of iptables/ip6tables.
|
||||
#
|
||||
# Best effort: if sysctl keys are unavailable (or we're in a container), fall back
|
||||
# to the historical physdev ACCEPT rules.
|
||||
|
||||
_bridge_sysctl_ok=true
|
||||
|
||||
if command -v systemd-detect-virt >/dev/null 2>&1 && systemd-detect-virt --container >/dev/null 2>&1 ; then
|
||||
_bridge_sysctl_ok=false
|
||||
else
|
||||
# ensure_mod br_netfilter is called earlier (Step 1a)
|
||||
sysctl -w net.bridge.bridge-nf-call-iptables=0 >/dev/null 2>&1 || _bridge_sysctl_ok=false
|
||||
sysctl -w net.bridge.bridge-nf-call-ip6tables=0 >/dev/null 2>&1 || _bridge_sysctl_ok=false
|
||||
sysctl -w net.bridge.bridge-nf-call-arptables=0 >/dev/null 2>&1 || _bridge_sysctl_ok=false
|
||||
fi
|
||||
|
||||
if ! $_bridge_sysctl_ok ; then
|
||||
# Fallback: allow bridged traffic to pass without filtering (legacy behaviour)
|
||||
$ipt -I FORWARD -m physdev --physdev-is-bridged -j ACCEPT
|
||||
$ipt -I FORWARD -m physdev --physdev-is-in -j ACCEPT
|
||||
$ipt -I FORWARD -m physdev --physdev-is-out -j ACCEPT
|
||||
fi
|
||||
|
||||
echo_done
|
||||
else
|
||||
echo_skipped
|
||||
fi
|
||||
echo
|
||||
|
||||
|
||||
# -------------
|
||||
# --- Do not firewall traffic from and to LX Gust Systems
|
||||
# -------------
|
||||
|
||||
echononl "\tDo not firewall traffic from and to LX Gust Systems"
|
||||
if $do_not_firewall_lx_guest_systems && [[ ${#lxc_guest_ip_arr[@]} -gt 0 ]]; then
|
||||
|
||||
for _ip in ${lxc_guest_ip_arr[@]} ; do
|
||||
|
||||
$ipt -I FORWARD -p all -d $_ip -j ACCEPT
|
||||
$ipt -I FORWARD -p all -s $_ip -j ACCEPT
|
||||
|
||||
done
|
||||
echo_done
|
||||
else
|
||||
echo_skipped
|
||||
fi
|
||||
echo
|
||||
|
||||
|
||||
# -------------
|
||||
# ---- Log given IP Addresses
|
||||
# -------------
|
||||
|
||||
Reference in New Issue
Block a user