From acd9efed95effcf03313832297e980b5caf32945 Mon Sep 17 00:00:00 2001 From: funman300 Date: Fri, 26 Jun 2026 09:13:00 -0700 Subject: [PATCH] fix: scope iptables NAT rule to loopback only to avoid breaking internet MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The broad OUTPUT 443→8443 redirect caught all HTTPS traffic system-wide. Scoping to -d 127.0.0.1 means only EA domains (resolved to 127.0.0.1 via /etc/hosts) are redirected; all real internet traffic is unaffected. Co-Authored-By: Claude Sonnet 4.6 --- setup.sh | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/setup.sh b/setup.sh index cc459c0..09e26aa 100755 --- a/setup.sh +++ b/setup.sh @@ -158,8 +158,8 @@ cmd_status() { warn "Hosts entries are NOT configured (run: ./setup.sh hosts)" fi - if sudo iptables -t nat -L OUTPUT -n 2>/dev/null | grep -q "redir ports $BRIDGE_PORT"; then - ok "NAT redirect 443→$BRIDGE_PORT is ACTIVE" + if sudo iptables -t nat -L OUTPUT -n -v 2>/dev/null | grep -q "redir ports $BRIDGE_PORT"; then + ok "NAT redirect 127.0.0.1:443→$BRIDGE_PORT is ACTIVE" else warn "NAT redirect is NOT active (run: ./setup.sh nat)" fi @@ -205,14 +205,17 @@ cmd_nat() { ok "NAT rule already active" return fi - sudo iptables -t nat -A OUTPUT -p tcp --dport 443 -j REDIRECT --to-port "$BRIDGE_PORT" - ok "iptables: OUTPUT 443 → $BRIDGE_PORT" + # Scope to 127.0.0.1 only — /etc/hosts resolves EA domains to loopback, so + # only those connections match. All real internet traffic goes to non-loopback + # IPs and is never redirected. + sudo iptables -t nat -A OUTPUT -p tcp -d 127.0.0.1 --dport 443 -j REDIRECT --to-port "$BRIDGE_PORT" + ok "iptables: OUTPUT 127.0.0.1:443 → $BRIDGE_PORT" warn "This rule is NOT persistent across reboots. Re-run './setup.sh nat' after reboot or use iptables-save." } cmd_unnat() { if sudo iptables -t nat -L OUTPUT -n 2>/dev/null | grep -q "redir ports $BRIDGE_PORT"; then - sudo iptables -t nat -D OUTPUT -p tcp --dport 443 -j REDIRECT --to-port "$BRIDGE_PORT" + sudo iptables -t nat -D OUTPUT -p tcp -d 127.0.0.1 --dport 443 -j REDIRECT --to-port "$BRIDGE_PORT" ok "Removed iptables NAT rule" fi }