51 lines
2.1 KiB
Bash
Executable file
51 lines
2.1 KiB
Bash
Executable file
#!/bin/bash
|
|
# =====================================================================
|
|
# VM LOCAL FIREWALL & PORT REDIRECTION SCRIPT
|
|
# VM IP: 172.16.9.10 | Internal Interface: eth0 (or similar)
|
|
# Redirects inbound 80/443 to non-root Caddy on 8080/8443
|
|
# =====================================================================
|
|
|
|
# 1. CLEAN SLATE
|
|
# Flush all rules and delete custom chains across filter and NAT tables
|
|
iptables -P INPUT ACCEPT
|
|
iptables -P FORWARD ACCEPT
|
|
iptables -P OUTPUT ACCEPT
|
|
iptables -t nat -F
|
|
iptables -F
|
|
iptables -X
|
|
iptables -t nat -X
|
|
|
|
# 2. LOCAL PORT REDIRECTION (Caddy Non-Root Helper)
|
|
# ---------------------------------------------------------------------
|
|
# A. Inbound traffic coming from outside the VM (e.g., forwarded from Proxmox)
|
|
iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-ports 8080
|
|
iptables -t nat -A PREROUTING -p tcp --dport 443 -j REDIRECT --to-ports 8443
|
|
|
|
# B. Local traffic generated inside the VM aimed strictly at localhost/127.0.0.1
|
|
# Note: By specifying '-o lo', you leave your outbound internet (GitHub, Google) untouched!
|
|
iptables -t nat -A OUTPUT -o lo -p tcp --dport 80 -j REDIRECT --to-ports 8080
|
|
iptables -t nat -A OUTPUT -o lo -p tcp --dport 443 -j REDIRECT --to-ports 8443
|
|
|
|
# 3. VM INPUT FIREWALL RULES
|
|
# ---------------------------------------------------------------------
|
|
# Allow everything on loopback
|
|
iptables -A INPUT -i lo -j ACCEPT
|
|
|
|
# Allow established connections (allows responses to your outbound traffic like curl)
|
|
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
|
|
|
|
# Allow SSH (Port 22) - Important for your Proxmox port forward (22910 -> 22)
|
|
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
|
|
|
|
# Allow the actual redirected Caddy ports from outside (just in case)
|
|
iptables -A INPUT -p tcp --dport 8080 -j ACCEPT
|
|
iptables -A INPUT -p tcp --dport 8443 -j ACCEPT
|
|
|
|
# Allow alternative app ports (like the 8000 you have forwarded in Proxmox)
|
|
iptables -A INPUT -p tcp --dport 8000 -j ACCEPT
|
|
|
|
# 4. GLOBAL SECURITY DROP RULE
|
|
# Drop all other unsolicited inbound traffic targeting this VM
|
|
iptables -A INPUT -j DROP
|
|
|
|
echo "VM Firewall and Caddy Redirection Applied Successfully."
|