72 lines
2.1 KiB
Bash
Executable File
72 lines
2.1 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
REPO_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
|
|
say(){ echo "[nft-fw-nd-priv] $*"; }
|
|
|
|
say "Creating directories..."
|
|
install -d -m 0755 /usr/local/sbin
|
|
|
|
say "Installing template..."
|
|
install -m 0644 "$REPO_DIR/templates/nftables.conf.in" /etc/nftables.conf.in
|
|
|
|
say "Installing scripts..."
|
|
install -m 0755 "$REPO_DIR/bin/fw-apply" /usr/local/sbin/fw-apply
|
|
install -m 0755 "$REPO_DIR/bin/fw-stop" /usr/local/sbin/fw-stop
|
|
|
|
|
|
say "Installing default config (won't overwrite existing)..."
|
|
if [[ ! -f /etc/default/nft-fw ]]; then
|
|
install -m 0644 "$REPO_DIR/etc-default/nft-fw-nd-priv" /etc/default/nft-fw
|
|
else
|
|
say "Config already exists at /etc/default/nft-fw (leaving as-is)."
|
|
fi
|
|
|
|
say "Installing systemd unit..."
|
|
install -m 0644 "$REPO_DIR/systemd/nft-fw.service" /etc/systemd/system/nft-fw.service
|
|
|
|
systemctl daemon-reload
|
|
systemctl enable nft-fw.service
|
|
|
|
say "Switching iptables binaries to nft backend (if available)..."
|
|
set_alt() {
|
|
local name="$1" target="$2"
|
|
if command -v update-alternatives >/dev/null 2>&1; then
|
|
if update-alternatives --list "$name" >/dev/null 2>&1; then
|
|
if update-alternatives --list "$name" | grep -qx "$target"; then
|
|
update-alternatives --set "$name" "$target" || true
|
|
say "Set alternative: $name -> $target"
|
|
fi
|
|
fi
|
|
fi
|
|
}
|
|
|
|
# Common paths on Debian/Ubuntu
|
|
set_alt iptables /usr/sbin/iptables-nft
|
|
set_alt ip6tables /usr/sbin/ip6tables-nft
|
|
set_alt arptables /usr/sbin/arptables-nft
|
|
set_alt ebtables /usr/sbin/ebtables-nft
|
|
|
|
say "Configuring fail2ban banaction for nftables (if installed)..."
|
|
if [[ -d /etc/fail2ban && -x /usr/bin/fail2ban-client ]]; then
|
|
install -d -m 0755 /etc/fail2ban/jail.d
|
|
cat > /etc/fail2ban/jail.d/nft-fw-nd-priv.local <<'JEOF'
|
|
[DEFAULT]
|
|
# Prefer nftables actions when the system uses nft backend
|
|
banaction = nftables-multiport
|
|
banaction_allports = nftables-allports
|
|
JEOF
|
|
say "Wrote /etc/fail2ban/jail.d/nft-fw-nd-priv.local"
|
|
systemctl restart fail2ban || true
|
|
else
|
|
say "fail2ban not found; skipping."
|
|
fi
|
|
|
|
say "Applying firewall now..."
|
|
/usr/local/sbin/fw-apply
|
|
|
|
say "Done. Edit /etc/default/nft-fw-nd-priv and re-run: fw-apply"
|
|
|
|
|