funman300/OpenFUT
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: scope iptables NAT rule to loopback only to avoid breaking internet

Browse Source 
The broad OUTPUT 443→8443 redirect caught all HTTPS traffic system-wide.
Scoping to -d 127.0.0.1 means only EA domains (resolved to 127.0.0.1 via
/etc/hosts) are redirected; all real internet traffic is unaffected.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
funman300
2026-06-26 09:13:00 -07:00
parent 06b6cdd043
commit acd9efed95
1 changed files with 8 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
setup.sh
+8 -5
View File
@@ -158,8 +158,8 @@ cmd_status() {
warn "Hosts entries are NOT configured (run: ./setup.sh hosts)" warn "Hosts entries are NOT configured (run: ./setup.sh hosts)"
fi fi
if sudo iptables -t nat -L OUTPUT -n 2>/dev/null | grep -q "redir ports $BRIDGE_PORT"; then if sudo iptables -t nat -L OUTPUT -n -v 2>/dev/null | grep -q "redir ports $BRIDGE_PORT"; then
ok "NAT redirect 443→$BRIDGE_PORT is ACTIVE" ok "NAT redirect 127.0.0.1:443→$BRIDGE_PORT is ACTIVE"
else else
warn "NAT redirect is NOT active (run: ./setup.sh nat)" warn "NAT redirect is NOT active (run: ./setup.sh nat)"
fi fi
@@ -205,14 +205,17 @@ cmd_nat() {
ok "NAT rule already active" ok "NAT rule already active"
return return
fi fi
sudo iptables -t nat -A OUTPUT -p tcp --dport 443 -j REDIRECT --to-port "$BRIDGE_PORT" # Scope to 127.0.0.1 only — /etc/hosts resolves EA domains to loopback, so
ok "iptables: OUTPUT 443 → $BRIDGE_PORT" # only those connections match. All real internet traffic goes to non-loopback
# IPs and is never redirected.
sudo iptables -t nat -A OUTPUT -p tcp -d 127.0.0.1 --dport 443 -j REDIRECT --to-port "$BRIDGE_PORT"
ok "iptables: OUTPUT 127.0.0.1:443 → $BRIDGE_PORT"
warn "This rule is NOT persistent across reboots. Re-run './setup.sh nat' after reboot or use iptables-save." warn "This rule is NOT persistent across reboots. Re-run './setup.sh nat' after reboot or use iptables-save."
} }
cmd_unnat() { cmd_unnat() {
if sudo iptables -t nat -L OUTPUT -n 2>/dev/null | grep -q "redir ports $BRIDGE_PORT"; then if sudo iptables -t nat -L OUTPUT -n 2>/dev/null | grep -q "redir ports $BRIDGE_PORT"; then
sudo iptables -t nat -D OUTPUT -p tcp --dport 443 -j REDIRECT --to-port "$BRIDGE_PORT" sudo iptables -t nat -D OUTPUT -p tcp -d 127.0.0.1 --dport 443 -j REDIRECT --to-port "$BRIDGE_PORT"
ok "Removed iptables NAT rule" ok "Removed iptables NAT rule"
fi fi
} }