23 lines
1.0 KiB
Bash
Executable File
23 lines
1.0 KiB
Bash
Executable File
#!/bin/bash
|
|
# Install + enable the host firewall. Run with sudo from the bundle dir.
|
|
# Keep your current SSH session open and test a NEW connection before closing it.
|
|
set -euo pipefail
|
|
cd "$(dirname "$0")"
|
|
[[ $EUID -eq 0 ]] || { echo "run with sudo"; exit 1; }
|
|
|
|
apt-get install -y -q nftables >/dev/null
|
|
install -m 0644 nftables.conf /etc/nftables.conf
|
|
|
|
echo "== syntax check"; nft -c -f /etc/nftables.conf
|
|
echo "== apply"; nft -f /etc/nftables.conf
|
|
systemctl enable nftables >/dev/null 2>&1 || true # loads /etc/nftables.conf at boot, before docker
|
|
|
|
echo "== active ruleset (vanguard table)"
|
|
nft list table inet vanguard | sed 's/^/ /'
|
|
echo
|
|
echo "== listening on public interfaces (should be 22 80 443 1935 2222 3306 8890 22000 only)"
|
|
ss -tulpnH | awk '$5 !~ /^(127\.|\[::1\])/ {print " "$1, $5}' | sort -u
|
|
echo
|
|
echo "Now open a SECOND terminal and confirm: ssh debian@$(hostname -f 2>/dev/null || hostname)"
|
|
echo "To restrict SSH to your IPs, edit the ssh_allow set in /etc/nftables.conf and re-run: sudo nft -f /etc/nftables.conf"
|