mirror of
https://github.com/Such-Software/wownerogue.git
synced 2026-10-19 15:18:33 +02:00
27 lines
1008 B
Bash
27 lines
1008 B
Bash
#!/bin/sh
|
|
set -eu
|
|
|
|
# Idempotent application/RPC isolation. Install mode 0755 at
|
|
# /usr/local/sbin/wowngeon-firewall and provide NPM_SOURCE_IPV4 through the unit's EnvironmentFile.
|
|
: "${NPM_SOURCE_IPV4:?Set NPM_SOURCE_IPV4 to the reverse proxy address}"
|
|
|
|
ensure_rule() {
|
|
command_name=$1
|
|
shift
|
|
if ! "$command_name" -C INPUT "$@" 2>/dev/null; then
|
|
"$command_name" -I INPUT 1 "$@"
|
|
fi
|
|
}
|
|
|
|
# Only the reverse proxy (and local probes) may reach either Node listener.
|
|
ensure_rule /usr/sbin/iptables ! -i lo ! -s "$NPM_SOURCE_IPV4" \
|
|
-p tcp -m multiport --dports 3000,3001 -j REJECT
|
|
ensure_rule /usr/sbin/ip6tables ! -i lo \
|
|
-p tcp -m multiport --dports 3000,3001 -j REJECT
|
|
|
|
# Wallet and daemon JSON-RPC are local control planes. P2P ports are intentionally untouched.
|
|
ensure_rule /usr/sbin/iptables ! -i lo \
|
|
-p tcp -m multiport --dports 34568,34570,38081,38083 -j REJECT
|
|
ensure_rule /usr/sbin/ip6tables ! -i lo \
|
|
-p tcp -m multiport --dports 34568,34570,38081,38083 -j REJECT
|