Skip to content

Commit 75ba5f0

Browse files
myreveryjaapmarcus
myrevery
and
jaapmarcus
authored
Improve firewall rules clean up and doc (hestiacp#3135)
* Clean up before saving the rules restore file * Apply update to firewall rules restore file * Upgrade backup added firewall rules restore file * Firewall doc added custom script usage * Update v-stop-firewall Co-authored-by: Jaap Marcus <9754650+jaapmarcus@users.noreply.github.com>
1 parent 2deb4f9 commit 75ba5f0

5 files changed

Lines changed: 97 additions & 64 deletions

File tree

‎bin/v-stop-firewall‎

Lines changed: 7 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -10,9 +10,8 @@
1010
# Variables & Functions #
1111
#----------------------------------------------------------#
1212

13-
# Defining absolute path for iptables and modprobe
13+
# Defining absolute path for iptables
1414
iptables="/sbin/iptables"
15-
modprobe="/sbin/modprobe"
1615

1716
# Includes
1817
# shellcheck source=/etc/hestiacp/hestia.conf
@@ -39,7 +38,7 @@ check_hestia_demo_mode
3938
heal_iptables_links
4039

4140
# Creating temporary file
42-
tmp=$(mktemp)
41+
tmp="$(mktemp)"
4342

4443
# Flushing INPUT chain
4544
echo "$iptables -P INPUT ACCEPT" >> $tmp
@@ -49,9 +48,8 @@ echo "$iptables -F INPUT" >> $tmp
4948
echo "$iptables -X hestia" >> $tmp
5049

5150
# Deleting custom chains
52-
chains=$(cat $HESTIA/data/firewall/chains.conf 2> /dev/null)
5351
IFS=$'\n'
54-
for chain in $chains; do
52+
for chain in $(cat $HESTIA/data/firewall/chains.conf 2> /dev/null); do
5553
parse_object_kv_list "$chain"
5654
echo "$iptables -F fail2ban-$CHAIN" >> $tmp
5755
echo "$iptables -X fail2ban-$CHAIN" >> $tmp
@@ -63,12 +61,12 @@ bash $tmp 2> /dev/null
6361
# Deleting temporary file
6462
rm -f $tmp
6563

66-
# Saving rules to the master iptables file
64+
# Clean up and saving rules to the master iptables file
6765
if [ -d "/etc/sysconfig" ]; then
68-
/sbin/iptables-save > /etc/sysconfig/iptables
66+
/sbin/iptables-save | sed -e 's/[[0-9]\+:[0-9]\+]/[0:0]/g' -e '/^-A fail2ban-[A-Z]\+ -s .\+$/d' > /etc/sysconfig/iptables
6967
else
70-
/sbin/iptables-save > /etc/iptables.rules
71-
iptablesversion=$(iptables --version | head -1 | awk '{print $2}' | cut -f -2 -d .)
68+
/sbin/iptables-save | sed -e 's/[[0-9]\+:[0-9]\+]/[0:0]/g' -e '/^-A fail2ban-[A-Z]\+ -s .\+$/d' > /etc/iptables.rules
69+
iptablesversion="$(iptables --version | head -1 | awk '{print $2}' | cut -f -2 -d .)"
7270
sd_unit="/lib/systemd/system/hestia-iptables.service"
7371
if [ ! -e "$sd_unit" ]; then
7472
echo "[Unit]" >> $sd_unit

‎bin/v-update-firewall‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -67,10 +67,10 @@ if [[ "$sshport" =~ ^[0-9]+$ ]] && [ "$sshport" -ne "22" ]; then
6767
fi
6868

6969
# Load ipset lists before adding Hestia iptables rules
70-
$BIN/v-update-firewall-ipset
70+
$BIN/v-update-firewall-ipset load
7171

7272
# Creating temporary file
73-
tmp=$(mktemp)
73+
tmp="$(mktemp)"
7474

7575
# Flushing INPUT chain
7676
echo "$iptables -P INPUT ACCEPT" >> $tmp
@@ -83,7 +83,7 @@ if [ "$conntrack" != 'no' ] || grep --quiet container=lxc /proc/1/environ; then
8383
echo "$str" >> $tmp
8484
fi
8585

86-
ips=$(ls $HESTIA/data/ips)
86+
ips="$(ls $HESTIA/data/ips)"
8787
# Handling local traffic
8888
for ip in $ips; do
8989
echo "$iptables -A INPUT -s $ip -j ACCEPT" >> $tmp
@@ -102,7 +102,7 @@ for line in $(sort -r -n -k 2 -t \' $rules); do
102102

103103
if [[ "$IP" =~ ^ipset: ]]; then
104104
ipset_name="${IP#ipset:}"
105-
$(v-list-firewall-ipset plain | grep "^$ipset_name\s" > /dev/null) || log_event $E_NOTEXIST "ipset object ($ipset_name) not found"
105+
$(v-list-firewall-ipset plain | grep "^$ipset_name\s" > /dev/null) || log_event $E_NOTEXIST "IPset IP list ($ipset_name) not found"
106106
ip="-m set --match-set '${ipset_name}' src"
107107
else
108108
ip="-s $IP"
@@ -176,12 +176,12 @@ if [ -n "$FIREWALL_EXTENSION" ]; then
176176
rm -f $tmp
177177
fi
178178

179-
# Saving rules to the master iptables file
179+
# Clean up and saving rules to the master iptables file
180180
if [ -d "/etc/sysconfig" ]; then
181-
/sbin/iptables-save > /etc/sysconfig/iptables
181+
/sbin/iptables-save | sed -e 's/[[0-9]\+:[0-9]\+]/[0:0]/g' -e '/^-A fail2ban-[A-Z]\+ -s .\+$/d' > /etc/sysconfig/iptables
182182
else
183-
/sbin/iptables-save > /etc/iptables.rules
184-
iptablesversion=$(iptables --version | head -1 | awk '{print $2}' | cut -f -2 -d .)
183+
/sbin/iptables-save | sed -e 's/[[0-9]\+:[0-9]\+]/[0:0]/g' -e '/^-A fail2ban-[A-Z]\+ -s .\+$/d' > /etc/iptables.rules
184+
iptablesversion="$(iptables --version | head -1 | awk '{print $2}' | cut -f -2 -d .)"
185185
sd_unit="/lib/systemd/system/hestia-iptables.service"
186186
if [ ! -e "$sd_unit" ]; then
187187
echo "[Unit]" >> $sd_unit

‎docs/docs/server-administration/firewall.md‎

Lines changed: 32 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
# Firewall
22

33
::: warning
4-
After every restart, Hestia will clear the current iptables unless the rules are added via Hestia.
4+
After every edit or update the firewall, Hestia will clear the current iptables unless the rules are added via Hestia and [custom script](#how-can-i-customize-iptables-rules).
55
:::
66

77
## How can I open or block a port or IP?
@@ -36,6 +36,37 @@ IPSet are large lists of IP addresses or subnets. They can be used for blacklist
3636
8. Choose whether to auto-update the list or not.
3737
9. Click the **<i class="fas fa-fw fa-save"></i> Save** button in the top right.
3838

39+
## How can I customize iptables rules?
40+
41+
::: danger
42+
This is dangerously advanced feature, please make sure you understand what you are doing.
43+
:::
44+
45+
Hestia supports setting custom rules, chains or flags, etc. using script.
46+
47+
Script must be here: `/usr/local/hestia/data/firewall/custom.sh`
48+
49+
1. Create custom.sh: `touch /usr/local/hestia/data/firewall/custom.sh`
50+
2. Make it executable: `chmod +x /usr/local/hestia/data/firewall/custom.sh`
51+
3. Edit it with your favorite editor.
52+
4. Test and make sure it works.
53+
5. To make custom rules persistent, run: `v-update-firewall`
54+
55+
**IMPLICIT PROTECTION:** Before making the rules persistent, if you screw up or lock yourself out of the server, just reboot.
56+
57+
custom.sh example:
58+
59+
```bash
60+
#!/bin/bash
61+
62+
IPTABLES="$(command -v iptables)"
63+
64+
$IPTABLES -N YOURCHAIN
65+
$IPTABLES -F YOURCHAIN
66+
$IPTABLES -I YOURCHAIN -s 0.0.0.0/0 -j RETURN
67+
$IPTABLES -I INPUT -p TCP -m multiport --dports 1:65535 -j YOURCHAIN
68+
```
69+
3970
## My IPSet doesn’t work
4071

4172
An IPSet must contain at least 10 IP or IP ranges.

‎func/upgrade.sh‎

Lines changed: 21 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -66,31 +66,31 @@ upgrade_welcome_message() {
6666
echo ' |_| |_|\___||___/\__|_|\__,_|\____|_| '
6767
echo " "
6868
echo " Hestia Control Panel Software Update "
69-
echo " Version: ${DISPLAY_VER} "
69+
echo " Version: ${DISPLAY_VER}"
7070
if [[ "$new_version" =~ "beta" ]]; then
71-
echo " BETA RELEASE "
71+
echo " BETA RELEASE "
7272
fi
7373
if [[ "$new_version" =~ "alpha" ]]; then
74-
echo " DEVELOPMENT SNAPSHOT "
75-
echo " NOT INTENDED FOR PRODUCTION USE "
76-
echo " USE AT YOUR OWN RISK "
74+
echo " DEVELOPMENT SNAPSHOT "
75+
echo " NOT INTENDED FOR PRODUCTION USE "
76+
echo " USE AT YOUR OWN RISK "
7777
fi
7878
echo
79-
echo "=============================================================================="
79+
echo "============================================================================="
8080
echo
81-
echo "[ ! ] IMPORTANT INFORMATION: "
81+
echo "[ ! ] IMPORTANT INFORMATION: "
8282
echo
83-
echo "Default configuration files and templates may be modified or replaced "
84-
echo "during the upgrade process. You may restore these files from: "
83+
echo "Default configuration files and templates may be modified or replaced "
84+
echo "during the upgrade process. You may restore these files from: "
8585
echo ""
86-
echo "Backup directory: $HESTIA_BACKUP/ "
87-
echo "Installation log: $LOG "
86+
echo "Backup directory: $HESTIA_BACKUP/"
87+
echo "Installation log: $LOG"
8888
}
8989

9090
upgrade_welcome_message_log() {
91-
echo "=============================================================================="
91+
echo "============================================================================="
9292
echo "Hestia Control Panel Software Update Log"
93-
echo "=============================================================================="
93+
echo "============================================================================="
9494
echo
9595
echo "OPERATING SYSTEM: $OS_TYPE ($OS_VERSION)"
9696
echo "CURRENT VERSION: $VERSION"
@@ -274,38 +274,6 @@ upgrade_init_backup() {
274274
# Hestia Control Panel configuration files
275275
mkdir -p $HESTIA_BACKUP/conf/hestia/
276276

277-
# System services (apache2, nginx, bind9, vsftpd, etc).
278-
if [ -n "$WEB_SYSTEM" ]; then
279-
mkdir -p $HESTIA_BACKUP/conf/$WEB_SYSTEM/
280-
fi
281-
if [ -n "$IMAP_SYSTEM" ]; then
282-
mkdir -p $HESTIA_BACKUP/conf/$IMAP_SYSTEM/
283-
fi
284-
if [ -n "$MAIL_SYSTEM" ]; then
285-
mkdir -p $HESTIA_BACKUP/conf/$MAIL_SYSTEM/
286-
fi
287-
if [ -n "$DNS_SYSTEM" ]; then
288-
mkdir -p $HESTIA_BACKUP/conf/$DNS_SYSTEM/
289-
fi
290-
if [ -n "$PROXY_SYSTEM" ]; then
291-
mkdir -p $HESTIA_BACKUP/conf/$PROXY_SYSTEM/
292-
fi
293-
if [ -n "$DB_SYSTEM" ]; then
294-
mkdir -p $HESTIA_BACKUP/conf/$DB_SYSTEM/
295-
fi
296-
if [ -n "$FTP_SYSTEM" ]; then
297-
mkdir -p $HESTIA_BACKUP/conf/$FTP_SYSTEM/
298-
fi
299-
if [ -n "$FIREWALL_SYSTEM" ]; then
300-
mkdir -p $HESTIA_BACKUP/conf/$FIREWALL_SYSTEM/
301-
fi
302-
if [ -n "$FIREWALL_EXTENSION" ]; then
303-
mkdir -p $HESTIA_BACKUP/conf/$FIREWALL_EXTENSION/
304-
fi
305-
if [ -e "/etc/ssh/sshd_config" ]; then
306-
mkdir -p $HESTIA_BACKUP/conf/ssh/
307-
fi
308-
309277
# Hosting Packages
310278
mkdir -p $HESTIA_BACKUP/packages/
311279

@@ -461,6 +429,13 @@ upgrade_start_backup() {
461429
cp -f /etc/proftpd/proftpd.conf $HESTIA_BACKUP/conf/$FTP_SYSTEM/
462430
fi
463431
fi
432+
if [ -n "$FIREWALL_SYSTEM" ]; then
433+
if [ "$DEBUG_MODE" = "true" ]; then
434+
echo " ---- $FIREWALL_SYSTEM"
435+
fi
436+
[ -e "/etc/sysconfig/iptables" ] && cp -f /etc/sysconfig/iptables $HESTIA_BACKUP/conf/$FIREWALL_SYSTEM/
437+
[ -e "/etc/iptables.rules" ] && cp -f /etc/iptables.rules $HESTIA_BACKUP/conf/$FIREWALL_SYSTEM/
438+
fi
464439
if [ -n "$FIREWALL_EXTENSION" ]; then
465440
if [ "$DEBUG_MODE" = "true" ]; then
466441
echo " ---- $FIREWALL_EXTENSION"
@@ -601,7 +576,7 @@ upgrade_phpmyadmin() {
601576
if [ ! -d /usr/share/phpmyadmin/tmp ]; then
602577
mkdir /usr/share/phpmyadmin/tmp
603578
chown root:www-data /usr/share/phpmyadmin/tmp
604-
chmod 770 /usr/share/phpmyadmin/tmp
579+
chmod 0770 /usr/share/phpmyadmin/tmp
605580

606581
fi
607582

‎install/upgrade/versions/1.6.14.sh‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
#!/bin/bash
2+
3+
# Hestia Control Panel upgrade script for target version 1.6.14
4+
5+
#######################################################################################
6+
####### Place additional commands below. #######
7+
#######################################################################################
8+
####### Pass through information to the end user in case of a issue or problem #######
9+
####### #######
10+
####### Use add_upgrade_message "My message here" to include a message #######
11+
####### in the upgrade notification email. Example: #######
12+
####### #######
13+
####### add_upgrade_message "My message here" #######
14+
####### #######
15+
####### You can use \n within the string to create new lines. #######
16+
#######################################################################################
17+
18+
upgrade_config_set_value 'UPGRADE_UPDATE_WEB_TEMPLATES' 'no'
19+
upgrade_config_set_value 'UPGRADE_UPDATE_DNS_TEMPLATES' 'no'
20+
upgrade_config_set_value 'UPGRADE_UPDATE_MAIL_TEMPLATES' 'no'
21+
upgrade_config_set_value 'UPGRADE_REBUILD_USERS' 'no'
22+
upgrade_config_set_value 'UPGRADE_UPDATE_FILEMANAGER_CONFIG' 'false'
23+
24+
# Clean up firewall rules restore file.
25+
if [ "$FIREWALL_SYSTEM" = "iptables" ]; then
26+
add_upgrade_message "About iptables rules [non-urgent]\n\nJust in case, if you added custom iptables rules in an unsupported way, they may have been lost.\n\nSee this issue to learn more:\nhttps://github.com/hestiacp/hestiacp/issues/3128"
27+
echo "[ * ] Clean up firewall rules restore file..."
28+
$BIN/v-update-firewall
29+
fi

0 commit comments

Comments
 (0)