Fix amnezia iptables rules

k8s/apps/amnezia/configmap-scripts.yaml

@@ -10,7 +10,6 @@ data:
 
     PORT="${1:-5847}"
     VPN_CIDR="${2:-10.8.0.0/16}"
-    INPUT_CHAIN="AMNEZIAWG-INPUT"
     FORWARD_CHAIN="AMNEZIAWG-FORWARD"
     IPTABLES=(iptables -w 30)
 
@@ -76,13 +75,9 @@ data:
     delete_rule INPUT -i awg0 -m comment --comment amneziawg-awg-input -j ACCEPT
     delete_rule FORWARD -i awg0 -m comment --comment amneziawg-forward-in -j ACCEPT
     delete_rule FORWARD -o awg0 -m comment --comment amneziawg-forward-out -j ACCEPT
-
+    delete_rule INPUT -m comment --comment amneziawg-input-jump -j AMNEZIAWG-INPUT
-    reset_chain "${INPUT_CHAIN}"
+    "${IPTABLES[@]}" -F AMNEZIAWG-INPUT >/dev/null 2>&1 || true
-    "${IPTABLES[@]}" -A "${INPUT_CHAIN}" -i "${EXT_IF}" -p udp --dport "${PORT}" -m comment --comment amneziawg-allow-external -j ACCEPT
+    "${IPTABLES[@]}" -X AMNEZIAWG-INPUT >/dev/null 2>&1 || true
-    "${IPTABLES[@]}" -A "${INPUT_CHAIN}" -i tailscale0 -p udp --dport "${PORT}" -m comment --comment amneziawg-block-tailscale -j DROP
-    "${IPTABLES[@]}" -A "${INPUT_CHAIN}" -i awg0 -m comment --comment amneziawg-awg-input -j ACCEPT
-    "${IPTABLES[@]}" -A "${INPUT_CHAIN}" -j RETURN
-    ensure_rule -I INPUT -m comment --comment amneziawg-input-jump -j "${INPUT_CHAIN}"
 
     reset_chain "${FORWARD_CHAIN}"
     "${IPTABLES[@]}" -A "${FORWARD_CHAIN}" -i awg0 -m comment --comment amneziawg-forward-in -j ACCEPT
@@ -100,7 +95,6 @@ data:
 
     PORT="${1:-5847}"
     VPN_CIDR="${2:-10.8.0.0/16}"
-    INPUT_CHAIN="AMNEZIAWG-INPUT"
     FORWARD_CHAIN="AMNEZIAWG-FORWARD"
     IPTABLES=(iptables -w 30)
 
@@ -139,11 +133,11 @@ data:
     delete_rule INPUT -i awg0 -m comment --comment amneziawg-awg-input -j ACCEPT
     delete_rule FORWARD -i awg0 -m comment --comment amneziawg-forward-in -j ACCEPT
     delete_rule FORWARD -o awg0 -m comment --comment amneziawg-forward-out -j ACCEPT
-    delete_rule INPUT -m comment --comment amneziawg-input-jump -j "${INPUT_CHAIN}"
+    delete_rule INPUT -m comment --comment amneziawg-input-jump -j AMNEZIAWG-INPUT
     delete_rule FORWARD -m comment --comment amneziawg-forward-jump -j "${FORWARD_CHAIN}"
 
-    "${IPTABLES[@]}" -F "${INPUT_CHAIN}" >/dev/null 2>&1 || true
+    "${IPTABLES[@]}" -F AMNEZIAWG-INPUT >/dev/null 2>&1 || true
-    "${IPTABLES[@]}" -X "${INPUT_CHAIN}" >/dev/null 2>&1 || true
+    "${IPTABLES[@]}" -X AMNEZIAWG-INPUT >/dev/null 2>&1 || true
     "${IPTABLES[@]}" -F "${FORWARD_CHAIN}" >/dev/null 2>&1 || true
     "${IPTABLES[@]}" -X "${FORWARD_CHAIN}" >/dev/null 2>&1 || true
 
@@ -153,7 +147,6 @@ data:
 
     PORT="${1:-5847}"
     VPN_CIDR="${2:-10.8.0.0/16}"
-    INPUT_CHAIN="AMNEZIAWG-INPUT"
     FORWARD_CHAIN="AMNEZIAWG-FORWARD"
     IPTABLES=(iptables -w 5)
 
@@ -178,11 +171,10 @@ data:
       echo "Unsafe broad UDP ACCEPT on ${EXT_IF} is present" >&2
       exit 1
     fi
-
+    if "${IPTABLES[@]}" -C INPUT -m comment --comment amneziawg-input-jump -j AMNEZIAWG-INPUT >/dev/null 2>&1; then
-    "${IPTABLES[@]}" -C INPUT -m comment --comment amneziawg-input-jump -j "${INPUT_CHAIN}"
+      echo "Unexpected AmneziaWG INPUT chain is present" >&2
-    "${IPTABLES[@]}" -C "${INPUT_CHAIN}" -i "${EXT_IF}" -p udp --dport "${PORT}" -m comment --comment amneziawg-allow-external -j ACCEPT
+      exit 1
-    "${IPTABLES[@]}" -C "${INPUT_CHAIN}" -i tailscale0 -p udp --dport "${PORT}" -m comment --comment amneziawg-block-tailscale -j DROP
+    fi
-    "${IPTABLES[@]}" -C "${INPUT_CHAIN}" -i awg0 -m comment --comment amneziawg-awg-input -j ACCEPT
 
     "${IPTABLES[@]}" -C FORWARD -m comment --comment amneziawg-forward-jump -j "${FORWARD_CHAIN}"
     "${IPTABLES[@]}" -C "${FORWARD_CHAIN}" -i awg0 -m comment --comment amneziawg-forward-in -j ACCEPT

k8s/apps/amnezia/daemonset.yaml

@@ -128,15 +128,24 @@ spec:
             periodSeconds: 10
             timeoutSeconds: 8
             failureThreshold: 2
+          startupProbe:
+            exec:
+              command:
+                - /bin/bash
+                - -lc
+                - /scripts/firewall-check.sh 5847 10.8.0.0/16 || /scripts/firewall-up.sh 5847 10.8.0.0/16
+            periodSeconds: 5
+            timeoutSeconds: 15
+            failureThreshold: 12
           livenessProbe:
             exec:
               command:
                 - /bin/bash
                 - -lc
-                - /scripts/firewall-check.sh 5847 10.8.0.0/16
+                - /scripts/firewall-check.sh 5847 10.8.0.0/16 || /scripts/firewall-up.sh 5847 10.8.0.0/16
             initialDelaySeconds: 30
             periodSeconds: 30
-            timeoutSeconds: 8
+            timeoutSeconds: 15
             failureThreshold: 3
           resources:
             requests: