81 lines
3.4 KiB
Bash
81 lines
3.4 KiB
Bash
#!/bin/bash
|
|
# ═══════════════════════════════════════════════════════════════════
|
|
# Firewall VPS VPN Server (WireGuard) — vpn-uber (45.150.111.158)
|
|
# Allow: WireGuard (51820/udp), SSH (22/tcp), Beszel agent (10001/tcp from VPN)
|
|
# Reject: tout le reste
|
|
# NAT: masquerade pour routage VPN
|
|
# ═══════════════════════════════════════════════════════════════════
|
|
|
|
set -e
|
|
|
|
echo "[*] Configurant firewall VPS VPN Server..."
|
|
|
|
# Flush des règles existantes
|
|
iptables -F
|
|
iptables -X
|
|
iptables -t nat -F
|
|
iptables -t nat -X
|
|
iptables -t mangle -F
|
|
iptables -t mangle -X
|
|
|
|
# Politique par défaut
|
|
iptables -P INPUT DROP
|
|
iptables -P FORWARD ACCEPT
|
|
iptables -P OUTPUT ACCEPT
|
|
|
|
# ─── INPUT ────────────────────────────────────────────────────────
|
|
# Loopback
|
|
iptables -A INPUT -i lo -j ACCEPT
|
|
|
|
# Established/Related
|
|
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
|
|
|
|
# SSH (administration)
|
|
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
|
|
|
|
# WireGuard
|
|
iptables -A INPUT -p udp --dport 51820 -j ACCEPT
|
|
|
|
# Beszel Agent (10001/tcp) — accessible depuis VPN uniquement
|
|
iptables -A INPUT -p tcp --dport 10001 -s 10.0.0.0/24 -j ACCEPT
|
|
|
|
# ICMP (ping, MTU discovery)
|
|
iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
|
|
iptables -A INPUT -p icmp --icmp-type destination-unreachable -j ACCEPT
|
|
iptables -A INPUT -p icmp --icmp-type time-exceeded -j ACCEPT
|
|
|
|
# Reject le reste
|
|
iptables -A INPUT -j REJECT --reject-with icmp-host-prohibited
|
|
|
|
# ─── FORWARD ──────────────────────────────────────────────────────
|
|
# VPN ↔ Internet
|
|
iptables -A FORWARD -i wg0 -j ACCEPT
|
|
iptables -A FORWARD -o wg0 -j ACCEPT
|
|
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
|
|
|
|
# ─── NAT ──────────────────────────────────────────────────────────
|
|
# Masquerade pour routage VPN
|
|
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
|
|
|
|
# ─── Sauvegarder ──────────────────────────────────────────────────
|
|
mkdir -p /etc/iptables
|
|
iptables-save > /etc/iptables/rules.v4
|
|
|
|
# ─── IP Forwarding ────────────────────────────────────────────────
|
|
sysctl -w net.ipv4.ip_forward=1
|
|
grep -q "net.ipv4.ip_forward" /etc/sysctl.conf || echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf
|
|
|
|
echo "[✓] Firewall VPS VPN Server configuré"
|
|
echo ""
|
|
echo "Règles appliquées (ALLOW) :"
|
|
echo " • SSH 22/tcp — administration"
|
|
echo " • WireGuard 51820/udp — VPN peers"
|
|
echo " • Beszel Agent 10001/tcp FROM 10.0.0.0/24 — monitoring dashboard"
|
|
echo " • ICMP (ping, MTU discovery)"
|
|
echo ""
|
|
echo "Configuration :"
|
|
echo " • FORWARD ACCEPT (VPN ↔ Internet routing)"
|
|
echo " • NAT masquerade activé (eth0)"
|
|
echo " • IP forwarding activé (net.ipv4.ip_forward=1)"
|
|
echo " • Default INPUT policy: DROP"
|