funman300/OpenFUT
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: scope iptables NAT rule to loopback only to avoid breaking internet

Browse Source 
The broad OUTPUT 443→8443 redirect caught all HTTPS traffic system-wide.
Scoping to -d 127.0.0.1 means only EA domains (resolved to 127.0.0.1 via
/etc/hosts) are redirected; all real internet traffic is unaffected.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
funman300
2026-06-26 09:13:00 -07:00
parent 06b6cdd043
commit acd9efed95
1 changed files with 8 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
setup.sh
+8 -5
View File
@@ -158,8 +158,8 @@ cmd_status() {
warn "Hosts entries are NOT configured (run: ./setup.sh hosts)"
fi
if sudo iptables -t nat -L OUTPUT -n 2>/dev/null | grep -q "redir ports $BRIDGE_PORT"; then
ok "NAT redirect 443→$BRIDGE_PORT is ACTIVE"
if sudo iptables -t nat -L OUTPUT -n -v 2>/dev/null | grep -q "redir ports $BRIDGE_PORT"; then
ok "NAT redirect 127.0.0.1:443→$BRIDGE_PORT is ACTIVE"
else
warn "NAT redirect is NOT active (run: ./setup.sh nat)"
fi
@@ -205,14 +205,17 @@ cmd_nat() {
ok "NAT rule already active"
return
fi
sudo iptables -t nat -A OUTPUT -p tcp --dport 443 -j REDIRECT --to-port "$BRIDGE_PORT"
ok "iptables: OUTPUT 443 → $BRIDGE_PORT"
# Scope to 127.0.0.1 only — /etc/hosts resolves EA domains to loopback, so
# only those connections match. All real internet traffic goes to non-loopback
# IPs and is never redirected.
sudo iptables -t nat -A OUTPUT -p tcp -d 127.0.0.1 --dport 443 -j REDIRECT --to-port "$BRIDGE_PORT"
ok "iptables: OUTPUT 127.0.0.1:443 → $BRIDGE_PORT"
warn "This rule is NOT persistent across reboots. Re-run './setup.sh nat' after reboot or use iptables-save."
}
cmd_unnat() {
if sudo iptables -t nat -L OUTPUT -n 2>/dev/null | grep -q "redir ports $BRIDGE_PORT"; then
sudo iptables -t nat -D OUTPUT -p tcp --dport 443 -j REDIRECT --to-port "$BRIDGE_PORT"
sudo iptables -t nat -D OUTPUT -p tcp -d 127.0.0.1 --dport 443 -j REDIRECT --to-port "$BRIDGE_PORT"
ok "Removed iptables NAT rule"
fi
}