chore: update

2026-08-08 12:04:57 +02:00
parent 56aef1fa9b
commit 8e36acd812
76 changed files with 12710 additions and 29 deletions
@@ -0,0 +1,80 @@
+#!/bin/bash
+# ═══════════════════════════════════════════════════════════════════
+# Firewall VPS VPN Server (WireGuard) — vpn-uber (45.150.111.158)
+# Allow: WireGuard (51820/udp), SSH (22/tcp), Beszel agent (10001/tcp from VPN)
+# Reject: tout le reste
+# NAT: masquerade pour routage VPN
+# ═══════════════════════════════════════════════════════════════════
+
+set -e
+
+echo "[*] Configurant firewall VPS VPN Server..."
+
+# Flush des règles existantes
+iptables -F
+iptables -X
+iptables -t nat -F
+iptables -t nat -X
+iptables -t mangle -F
+iptables -t mangle -X
+
+# Politique par défaut
+iptables -P INPUT DROP
+iptables -P FORWARD ACCEPT
+iptables -P OUTPUT ACCEPT
+
+# ─── INPUT ────────────────────────────────────────────────────────
+# Loopback
+iptables -A INPUT -i lo -j ACCEPT
+
+# Established/Related
+iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
+
+# SSH (administration)
+iptables -A INPUT -p tcp --dport 22 -j ACCEPT
+
+# WireGuard
+iptables -A INPUT -p udp --dport 51820 -j ACCEPT
+
+# Beszel Agent (10001/tcp) — accessible depuis VPN uniquement
+iptables -A INPUT -p tcp --dport 10001 -s 10.0.0.0/24 -j ACCEPT
+
+# ICMP (ping, MTU discovery)
+iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
+iptables -A INPUT -p icmp --icmp-type destination-unreachable -j ACCEPT
+iptables -A INPUT -p icmp --icmp-type time-exceeded -j ACCEPT
+
+# Reject le reste
+iptables -A INPUT -j REJECT --reject-with icmp-host-prohibited
+
+# ─── FORWARD ──────────────────────────────────────────────────────
+# VPN ↔ Internet
+iptables -A FORWARD -i wg0 -j ACCEPT
+iptables -A FORWARD -o wg0 -j ACCEPT
+iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
+
+# ─── NAT ──────────────────────────────────────────────────────────
+# Masquerade pour routage VPN
+iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
+
+# ─── Sauvegarder ──────────────────────────────────────────────────
+mkdir -p /etc/iptables
+iptables-save > /etc/iptables/rules.v4
+
+# ─── IP Forwarding ────────────────────────────────────────────────
+sysctl -w net.ipv4.ip_forward=1
+grep -q "net.ipv4.ip_forward" /etc/sysctl.conf || echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf
+
+echo "[✓] Firewall VPS VPN Server configuré"
+echo ""
+echo "Règles appliquées (ALLOW) :"
+echo "  • SSH 22/tcp — administration"
+echo "  • WireGuard 51820/udp — VPN peers"
+echo "  • Beszel Agent 10001/tcp FROM 10.0.0.0/24 — monitoring dashboard"
+echo "  • ICMP (ping, MTU discovery)"
+echo ""
+echo "Configuration :"
+echo "  • FORWARD ACCEPT (VPN ↔ Internet routing)"
+echo "  • NAT masquerade activé (eth0)"
+echo "  • IP forwarding activé (net.ipv4.ip_forward=1)"
+echo "  • Default INPUT policy: DROP"