ab/homelab
1
1
Fork 1
Code Issues Pull Requests 130 Actions Packages Wiki Activity

Fix amnezia iptables rules
Update Kubernetes Services Wiki / Generate and Update K8s Wiki (push) Successful in 6s
Details
Check with kubeconform / lint (push) Successful in 7s
Details
Auto-update README / Generate README and Create MR (push) Successful in 5s
Details

Browse Source
This commit is contained in:
Ultradesu
2026-07-28 13:17:12 +01:00
parent 1059e430a0
commit 719504a399
2 changed files with 21 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
k8s/apps/amnezia/configmap-scripts.yaml
+10 -18
View File
@@ -10,7 +10,6 @@ data:
PORT="${1:-5847}"
VPN_CIDR="${2:-10.8.0.0/16}"
INPUT_CHAIN="AMNEZIAWG-INPUT"
FORWARD_CHAIN="AMNEZIAWG-FORWARD"
IPTABLES=(iptables -w 30)
@@ -76,13 +75,9 @@ data:
delete_rule INPUT -i awg0 -m comment --comment amneziawg-awg-input -j ACCEPT
delete_rule FORWARD -i awg0 -m comment --comment amneziawg-forward-in -j ACCEPT
delete_rule FORWARD -o awg0 -m comment --comment amneziawg-forward-out -j ACCEPT
reset_chain "${INPUT_CHAIN}"
"${IPTABLES[@]}" -A "${INPUT_CHAIN}" -i "${EXT_IF}" -p udp --dport "${PORT}" -m comment --comment amneziawg-allow-external -j ACCEPT
"${IPTABLES[@]}" -A "${INPUT_CHAIN}" -i tailscale0 -p udp --dport "${PORT}" -m comment --comment amneziawg-block-tailscale -j DROP
"${IPTABLES[@]}" -A "${INPUT_CHAIN}" -i awg0 -m comment --comment amneziawg-awg-input -j ACCEPT
"${IPTABLES[@]}" -A "${INPUT_CHAIN}" -j RETURN
ensure_rule -I INPUT -m comment --comment amneziawg-input-jump -j "${INPUT_CHAIN}"
delete_rule INPUT -m comment --comment amneziawg-input-jump -j AMNEZIAWG-INPUT
"${IPTABLES[@]}" -F AMNEZIAWG-INPUT >/dev/null 2>&1 || true
"${IPTABLES[@]}" -X AMNEZIAWG-INPUT >/dev/null 2>&1 || true
reset_chain "${FORWARD_CHAIN}"
"${IPTABLES[@]}" -A "${FORWARD_CHAIN}" -i awg0 -m comment --comment amneziawg-forward-in -j ACCEPT
@@ -100,7 +95,6 @@ data:
PORT="${1:-5847}"
VPN_CIDR="${2:-10.8.0.0/16}"
INPUT_CHAIN="AMNEZIAWG-INPUT"
FORWARD_CHAIN="AMNEZIAWG-FORWARD"
IPTABLES=(iptables -w 30)
@@ -139,11 +133,11 @@ data:
delete_rule INPUT -i awg0 -m comment --comment amneziawg-awg-input -j ACCEPT
delete_rule FORWARD -i awg0 -m comment --comment amneziawg-forward-in -j ACCEPT
delete_rule FORWARD -o awg0 -m comment --comment amneziawg-forward-out -j ACCEPT
delete_rule INPUT -m comment --comment amneziawg-input-jump -j "${INPUT_CHAIN}"
delete_rule INPUT -m comment --comment amneziawg-input-jump -j AMNEZIAWG-INPUT
delete_rule FORWARD -m comment --comment amneziawg-forward-jump -j "${FORWARD_CHAIN}"
"${IPTABLES[@]}" -F "${INPUT_CHAIN}" >/dev/null 2>&1 || true
"${IPTABLES[@]}" -X "${INPUT_CHAIN}" >/dev/null 2>&1 || true
"${IPTABLES[@]}" -F AMNEZIAWG-INPUT >/dev/null 2>&1 || true
"${IPTABLES[@]}" -X AMNEZIAWG-INPUT >/dev/null 2>&1 || true
"${IPTABLES[@]}" -F "${FORWARD_CHAIN}" >/dev/null 2>&1 || true
"${IPTABLES[@]}" -X "${FORWARD_CHAIN}" >/dev/null 2>&1 || true
@@ -153,7 +147,6 @@ data:
PORT="${1:-5847}"
VPN_CIDR="${2:-10.8.0.0/16}"
INPUT_CHAIN="AMNEZIAWG-INPUT"
FORWARD_CHAIN="AMNEZIAWG-FORWARD"
IPTABLES=(iptables -w 5)
@@ -178,11 +171,10 @@ data:
echo "Unsafe broad UDP ACCEPT on ${EXT_IF} is present" >&2
exit 1
fi
"${IPTABLES[@]}" -C INPUT -m comment --comment amneziawg-input-jump -j "${INPUT_CHAIN}"
"${IPTABLES[@]}" -C "${INPUT_CHAIN}" -i "${EXT_IF}" -p udp --dport "${PORT}" -m comment --comment amneziawg-allow-external -j ACCEPT
"${IPTABLES[@]}" -C "${INPUT_CHAIN}" -i tailscale0 -p udp --dport "${PORT}" -m comment --comment amneziawg-block-tailscale -j DROP
"${IPTABLES[@]}" -C "${INPUT_CHAIN}" -i awg0 -m comment --comment amneziawg-awg-input -j ACCEPT
if "${IPTABLES[@]}" -C INPUT -m comment --comment amneziawg-input-jump -j AMNEZIAWG-INPUT >/dev/null 2>&1; then
echo "Unexpected AmneziaWG INPUT chain is present" >&2
exit 1
fi
"${IPTABLES[@]}" -C FORWARD -m comment --comment amneziawg-forward-jump -j "${FORWARD_CHAIN}"
"${IPTABLES[@]}" -C "${FORWARD_CHAIN}" -i awg0 -m comment --comment amneziawg-forward-in -j ACCEPT
k8s/apps/amnezia/daemonset.yaml
+11 -2
View File
@@ -128,15 +128,24 @@ spec:
periodSeconds: 10
timeoutSeconds: 8
failureThreshold: 2
startupProbe:
exec:
command:
- /bin/bash
- -lc
- /scripts/firewall-check.sh 5847 10.8.0.0/16 || /scripts/firewall-up.sh 5847 10.8.0.0/16
periodSeconds: 5
timeoutSeconds: 15
failureThreshold: 12
livenessProbe:
exec:
command:
- /bin/bash
- -lc
- /scripts/firewall-check.sh 5847 10.8.0.0/16
- /scripts/firewall-check.sh 5847 10.8.0.0/16 || /scripts/firewall-up.sh 5847 10.8.0.0/16
initialDelaySeconds: 30
periodSeconds: 30
timeoutSeconds: 8
timeoutSeconds: 15
failureThreshold: 3
resources:
requests: