Skip to content

Commit 1215cf9

Browse files
jaapmarcusjaapmarcus
authored
Merge pull request hestiacp#1892 from myrevery/fix/firewall-rules
[Bug Fix] Improve generate and loading firewall rules
2 parents b4bb08d + 976cd27 commit 1215cf9

File tree

4 files changed

+58
-58
lines changed

4 files changed

+58
-58
lines changed

‎CHANGELOG.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ All notable changes to this project will be documented in this file.
1010
### Bugfixes
1111

1212
- Improve the calculated disk size of a new backup estimated by excluding the exclude folders, mail accounts and database in backups (#1616) @Myself5
13+
- Improve v-update-firewall / v-stop-firewarewall to make it self healing (#1892) @myrevery
1314
- Update phpMyAdmin version to 1.5.1 (See https://www.phpmyadmin.net/news/2021/6/4/phpmyadmin-511-released/)
1415
- Fixed a bug after rebuilding mail with Exim4 and suspended domains (#1886)
1516
- Fixed "Allowed IP addresses for API" field with strange behaviour #1866

‎bin/v-stop-firewall‎

Lines changed: 20 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -76,33 +76,28 @@ if [ -d "/etc/sysconfig" ]; then
7676
fi
7777
else
7878
/sbin/iptables-save > /etc/iptables.rules
79+
routable="/usr/lib/networkd-dispatcher/routable.d/10-hestia-iptables"
80+
preup="/etc/network/if-pre-up.d/hestia-iptables"
81+
# Recreate the Hestia iptables rules loading script
82+
rm -f $routable $preup
7983
if dpkg-query -W -f'${Status}' "netplan*" 2>/dev/null | grep -q "ok installed" && [ -d /etc/netplan ] && [ -n "$(ls -A /etc/netplan 2>/dev/null)" ]; then
80-
preup="/usr/lib/networkd-dispatcher/routable.d/10-hestia-iptables"
81-
if [ ! -e "$preup" ]; then
82-
IFS='%'
83-
echo '#!/bin/sh' > $preup
84-
echo '' >> $preup
85-
echo 'if [ "$IFACE" = "'$(ip route list | awk '/default .+/ {print $5}' | uniq)'" ]; then' >> $preup
86-
[ -x "$(which ipset)" ] && echo " ${HESTIA}/bin/v-update-firewall-ipset" >> $preup
87-
echo ' sleep 3' >> $preup
88-
echo ' /sbin/iptables-restore < /etc/iptables.rules' >> $preup
89-
echo 'fi' >> $preup
90-
echo "exit 0" >> $preup
91-
chmod +x $preup
92-
fi
84+
echo '#!/bin/sh' > $routable
85+
echo '' >> $routable
86+
echo 'if [ "$IFACE" = "'$(ip route list | awk '/default .+/ {print $5}' | uniq)'" ]; then' >> $routable
87+
echo ' /sbin/iptables-restore < /etc/iptables.rules' >> $routable
88+
echo 'fi' >> $routable
89+
echo '' >> $routable
90+
echo "exit 0" >> $routable
91+
chmod +x $routable
9392
else
94-
preup="/etc/network/if-pre-up.d/hestia-iptables"
95-
if [ ! -e "$preup" ]; then
96-
IFS='%'
97-
echo '#!/bin/sh' > $preup
98-
echo '' >> $preup
99-
echo 'if [ "$IFACE" = "'$(ip route list | awk '/default .+/ {print $5}' | uniq)'" ]; then' >> $preup
100-
[ -x "$(which ipset)" ] && echo " ${HESTIA}/bin/v-update-firewall-ipset" >> $preup
101-
echo ' /sbin/iptables-restore < /etc/iptables.rules' >> $preup
102-
echo 'fi' >> $preup
103-
echo "exit 0" >> $preup
104-
chmod +x $preup
105-
fi
93+
echo '#!/bin/sh' > $preup
94+
echo '' >> $preup
95+
echo 'if [ "$IFACE" = "'$(ip route list | awk '/default .+/ {print $5}' | uniq)'" ]; then' >> $preup
96+
echo ' /sbin/iptables-restore < /etc/iptables.rules' >> $preup
97+
echo 'fi' >> $preup
98+
echo '' >> $preup
99+
echo "exit 0" >> $preup
100+
chmod +x $preup
106101
fi
107102
fi
108103

‎bin/v-update-firewall‎

Lines changed: 32 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -18,12 +18,12 @@ modprobe="/sbin/modprobe"
1818
sysctl="/sbin/sysctl"
1919

2020
# Includes
21-
# shellcheck source=/usr/local/hestia/func/main.sh
22-
# shellcheck source=/usr/local/hestia/func/firewall.sh
23-
# shellcheck source=/usr/local/hestia/conf/hestia.conf
2421
source /etc/profile.d/hestia.sh
22+
# shellcheck source=/usr/local/hestia/func/main.sh
2523
source $HESTIA/func/main.sh
24+
# shellcheck source=/usr/local/hestia/func/firewall.sh
2625
source $HESTIA/func/firewall.sh
26+
# shellcheck source=/usr/local/hestia/conf/hestia.conf
2727
source $HESTIA/conf/hestia.conf
2828

2929

@@ -48,13 +48,15 @@ if [ ! -e "$rules" ]; then
4848
exit
4949
fi
5050

51-
$sysctl net.netfilter.nf_conntrack_max >/dev/null 2>&1
51+
# Checking conntrack module avaiabilty
52+
$modprobe nf_conntrack >/dev/null 2>&1
5253
if [ $? -ne 0 ]; then
53-
conntrack='no'
54+
$sysctl net.netfilter.nf_conntrack_max >/dev/null 2>&1
55+
if [ $? -ne 0 ]; then
56+
conntrack='no'
57+
fi
5458
fi
5559

56-
# Checking conntrack module avaiabilty
57-
$modprobe nf_conntrack >/dev/null 2>&1
5860
$modprobe nf_conntrack_ftp >/dev/null 2>&1
5961
if [ $? -ne 0 ]; then
6062
conntrack_ftp='no'
@@ -67,7 +69,7 @@ if [[ "$sshport" =~ ^[0-9]+$ ]] && [ "$sshport" -ne "22" ]; then
6769
fi
6870

6971
# Load ipset lists before adding Hestia iptables rules
70-
$BIN/v-update-firewall-ipset
72+
[ -x "$(which ipset)" ] && $BIN/v-update-firewall-ipset
7173

7274
# Creating temporary file
7375
tmp=$(mktemp)
@@ -183,33 +185,30 @@ if [ -d "/etc/sysconfig" ]; then
183185
fi
184186
else
185187
/sbin/iptables-save > /etc/iptables.rules
188+
routable="/usr/lib/networkd-dispatcher/routable.d/10-hestia-iptables"
189+
preup="/etc/network/if-pre-up.d/hestia-iptables"
190+
# Recreate the Hestia iptables rules loading script
191+
rm -f $routable $preup
186192
if dpkg-query -W -f'${Status}' "netplan*" 2>/dev/null | grep -q "ok installed" && [ -d /etc/netplan ] && [ -n "$(ls -A /etc/netplan 2>/dev/null)" ]; then
187-
preup="/usr/lib/networkd-dispatcher/routable.d/10-hestia-iptables"
188-
if [ ! -e "$preup" ]; then
189-
IFS='%'
190-
echo '#!/bin/sh' > $preup
191-
echo '' >> $preup
192-
echo 'if [ "$IFACE" = "'$(ip route list | awk '/default .+/ {print $5}' | uniq)'" ]; then' >> $preup
193-
[ -x "$(which ipset)" ] && echo " ${HESTIA}/bin/v-update-firewall-ipset" >> $preup
194-
echo ' sleep 3' >> $preup
195-
echo ' /sbin/iptables-restore < /etc/iptables.rules' >> $preup
196-
echo 'fi' >> $preup
197-
echo "exit 0" >> $preup
198-
chmod +x $preup
199-
fi
193+
echo '#!/bin/sh' > $routable
194+
echo '' >> $routable
195+
echo 'if [ "$IFACE" = "'$(ip route list | awk '/default .+/ {print $5}' | uniq)'" ]; then' >> $routable
196+
echo ' [ -x "'$(which ipset)'" ] && '"${HESTIA}/bin/v-update-firewall-ipset" >> $routable
197+
echo ' /sbin/iptables-restore < /etc/iptables.rules' >> $routable
198+
echo 'fi' >> $routable
199+
echo '' >> $routable
200+
echo "exit 0" >> $routable
201+
chmod +x $routable
200202
else
201-
preup="/etc/network/if-pre-up.d/hestia-iptables"
202-
if [ ! -e "$preup" ]; then
203-
IFS='%'
204-
echo '#!/bin/sh' > $preup
205-
echo '' >> $preup
206-
echo 'if [ "$IFACE" = "'$(ip route list | awk '/default .+/ {print $5}' | uniq)'" ]; then' >> $preup
207-
[ -x "$(which ipset)" ] && echo " ${HESTIA}/bin/v-update-firewall-ipset" >> $preup
208-
echo ' /sbin/iptables-restore < /etc/iptables.rules' >> $preup
209-
echo 'fi' >> $preup
210-
echo "exit 0" >> $preup
211-
chmod +x $preup
212-
fi
203+
echo '#!/bin/sh' > $preup
204+
echo '' >> $preup
205+
echo 'if [ "$IFACE" = "'$(ip route list | awk '/default .+/ {print $5}' | uniq)'" ]; then' >> $preup
206+
echo ' [ -x "'$(which ipset)'" ] && '"${HESTIA}/bin/v-update-firewall-ipset" >> $preup
207+
echo ' /sbin/iptables-restore < /etc/iptables.rules' >> $preup
208+
echo 'fi' >> $preup
209+
echo '' >> $preup
210+
echo "exit 0" >> $preup
211+
chmod +x $preup
213212
fi
214213
fi
215214

‎install/upgrade/versions/1.4.3.sh‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,3 +6,8 @@
66
####### Place additional commands below. #######
77
#######################################################################################
88

9+
# Improve generate and loading firewall rules
10+
if [ "$FIREWALL_SYSTEM" = "iptables" ]; then
11+
echo "[ * ] Fix the issue of generate firewall rules..."
12+
$BIN/v-update-firewall
13+
fi

0 commit comments

Comments
 (0)