7eac63343d
Light/dark theme and compact mobile layout, per-client speed limit, real speed tests, panel domain (Let's Encrypt), client address + cascade relay, RKN scanner guard, WARP, backup/restore, router web terminal, Android VPN client with split tunnelling and Android admin app. Updating from 1.2.x keeps keys, server.env and clients; tested 1.2.8 -> 1.4.0 on live VMs. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
114 lines
4.3 KiB
Bash
Executable File
114 lines
4.3 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# PCA Phobos — guard: drop RKN probes / scanner subnets before they reach the server.
|
|
# Idea and IP list: github.com/Loorrr293/Auto_IPtables (list: Loorrr293/blocklist).
|
|
# We only download the IP list (data), never third-party code.
|
|
# phobos-guard.sh enable [list_url] install nft table + daily timer
|
|
# phobos-guard.sh update refresh the list now
|
|
# phobos-guard.sh disable remove table + timer
|
|
# phobos-guard.sh status JSON
|
|
set -uo pipefail
|
|
STATE=/etc/phobos-guard.env
|
|
DEFAULT_URL="https://raw.githubusercontent.com/Loorrr293/blocklist/main/blocklist.txt"
|
|
TABLE="inet phobos_guard"
|
|
SELF="$(readlink -f "$0")"
|
|
|
|
list_url() { [ -f "$STATE" ] && . "$STATE"; echo "${GUARD_URL:-$DEFAULT_URL}"; }
|
|
|
|
ensure_nft() {
|
|
command -v nft >/dev/null 2>&1 && return 0
|
|
DEBIAN_FRONTEND=noninteractive apt-get install -y -qq nftables >/dev/null 2>&1
|
|
}
|
|
|
|
update_list() {
|
|
local url tmp nf
|
|
url="$(list_url)"
|
|
tmp="$(mktemp)"; nf="$(mktemp)"
|
|
curl -fsSL -m60 "$url" -o "$tmp" || { rm -f "$tmp" "$nf"; echo "download failed: $url" >&2; return 1; }
|
|
nft add table $TABLE 2>/dev/null || true
|
|
nft add set $TABLE v4 '{ type ipv4_addr; flags interval; auto-merge; }' 2>/dev/null || true
|
|
nft add set $TABLE v6 '{ type ipv6_addr; flags interval; auto-merge; }' 2>/dev/null || true
|
|
nft add chain $TABLE input '{ type filter hook input priority raw; policy accept; }' 2>/dev/null || true
|
|
nft list chain $TABLE input | grep -q '@v4' || nft add rule $TABLE input ip saddr @v4 counter drop
|
|
nft list chain $TABLE input | grep -q '@v6' || nft add rule $TABLE input ip6 saddr @v6 counter drop
|
|
# collapse + skip private/loopback so a bad list can never cut LAN/tunnel/admin
|
|
python3 - "$tmp" > "$nf" <<'PY'
|
|
import ipaddress, sys
|
|
v4, v6 = [], []
|
|
for line in open(sys.argv[1], encoding="utf-8", errors="ignore"):
|
|
for tok in line.split("#", 1)[0].split():
|
|
try:
|
|
n = ipaddress.ip_network(tok, strict=False)
|
|
except ValueError:
|
|
continue
|
|
if n.is_private or n.is_loopback or n.is_link_local or n.prefixlen == 0:
|
|
continue
|
|
(v6 if n.version == 6 else v4).append(n)
|
|
print("flush set inet phobos_guard v4")
|
|
print("flush set inet phobos_guard v6")
|
|
for name, nets in (("v4", v4), ("v6", v6)):
|
|
nets = list(ipaddress.collapse_addresses(nets))
|
|
for i in range(0, len(nets), 2000):
|
|
print("add element inet phobos_guard %s { %s }" % (name, ", ".join(map(str, nets[i:i + 2000]))))
|
|
PY
|
|
local rc=0
|
|
nft -f "$nf" || rc=1
|
|
rm -f "$tmp" "$nf"
|
|
[ "$rc" = 0 ] && echo "guard: list loaded from $url"
|
|
return "$rc"
|
|
}
|
|
|
|
enable() {
|
|
ensure_nft || { echo "nftables install failed" >&2; exit 1; }
|
|
[ -n "${1:-}" ] && echo "GUARD_URL=$1" > "$STATE" || touch "$STATE"
|
|
cat > /etc/systemd/system/phobos-guard.service <<EOF
|
|
[Unit]
|
|
Description=PCA Phobos guard (RKN scanner blocklist)
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
[Service]
|
|
Type=oneshot
|
|
ExecStart=$SELF update
|
|
EOF
|
|
cat > /etc/systemd/system/phobos-guard.timer <<'EOF'
|
|
[Unit]
|
|
Description=Refresh PCA Phobos guard list daily
|
|
[Timer]
|
|
OnBootSec=1min
|
|
OnCalendar=daily
|
|
RandomizedDelaySec=1h
|
|
Persistent=true
|
|
[Install]
|
|
WantedBy=timers.target
|
|
EOF
|
|
systemctl daemon-reload
|
|
systemctl enable --now phobos-guard.timer >/dev/null 2>&1
|
|
update_list
|
|
}
|
|
|
|
disable() {
|
|
systemctl disable --now phobos-guard.timer >/dev/null 2>&1 || true
|
|
rm -f /etc/systemd/system/phobos-guard.service /etc/systemd/system/phobos-guard.timer "$STATE"
|
|
systemctl daemon-reload
|
|
nft delete table $TABLE 2>/dev/null || true
|
|
echo "guard: disabled"
|
|
}
|
|
|
|
status() {
|
|
local on=false n4=0 drops=0
|
|
if nft list table $TABLE >/dev/null 2>&1; then
|
|
on=true
|
|
n4=$(nft list set $TABLE v4 2>/dev/null | grep -o '[0-9.]*/[0-9]*\|[0-9]*\.[0-9]*\.[0-9]*\.[0-9]*' | wc -l)
|
|
drops=$(nft list chain $TABLE input 2>/dev/null | grep -o 'packets [0-9]*' | awk '{s+=$2} END {print s+0}')
|
|
fi
|
|
printf '{"enabled": %s, "networks": %s, "dropped_packets": %s, "timer": "%s", "url": "%s"}\n' \
|
|
"$on" "$n4" "$drops" "$(systemctl is-active phobos-guard.timer 2>/dev/null)" "$(list_url)"
|
|
}
|
|
|
|
case "${1:-status}" in
|
|
enable) enable "${2:-}" ;;
|
|
update) update_list ;;
|
|
disable) disable ;;
|
|
status) status ;;
|
|
*) echo "usage: $0 enable [url]|update|disable|status"; exit 2 ;;
|
|
esac
|