mirror of
https://github.com/jmcorgan/fips.git
synced 2026-07-30 19:46:15 +00:00
Origami74
c8b7459fbc
Add a complete example running a strfry Nostr relay exclusively over the FIPS mesh using the sidecar pattern. Includes Docker Compose stack, network isolation via iptables, .fips DNS resolution, nak CLI, build script with cross-compilation support, and documentation. Also fix the package-openwrt.yml workflow path to match the openwrt → openwrt-ipk directory rename.
34 lines
1.2 KiB
Bash
34 lines
1.2 KiB
Bash
#!/bin/sh
|
|
# FIPS firewall rules — accept all traffic on the FIPS TUN interface.
|
|
#
|
|
# Called by:
|
|
# - /etc/hotplug.d/net/99-fips when fips0 comes up
|
|
# - the UCI firewall include on every firewall reload
|
|
#
|
|
# Supports both fw4 (nftables, OpenWrt 22.03+) and older iptables builds.
|
|
|
|
TUN="fips0"
|
|
|
|
if command -v nft >/dev/null 2>&1 && nft list table inet fw4 >/dev/null 2>&1; then
|
|
for chain in input output forward; do
|
|
case "$chain" in
|
|
input|forward) match="iifname \"$TUN\"" ;;
|
|
output) match="oifname \"$TUN\"" ;;
|
|
esac
|
|
nft list chain inet fw4 "$chain" 2>/dev/null | grep -q "$match" || \
|
|
nft insert rule inet fw4 "$chain" $match accept comment "\"fips\""
|
|
done
|
|
# Also accept forwarded traffic leaving via fips0
|
|
nft list chain inet fw4 forward 2>/dev/null | grep -q "oifname \"$TUN\"" || \
|
|
nft insert rule inet fw4 forward oifname "$TUN" accept comment '"fips"'
|
|
fi
|
|
|
|
if command -v iptables >/dev/null 2>&1; then
|
|
iptables -C INPUT -i "$TUN" -j ACCEPT 2>/dev/null || \
|
|
iptables -I INPUT 1 -i "$TUN" -j ACCEPT
|
|
iptables -C OUTPUT -o "$TUN" -j ACCEPT 2>/dev/null || \
|
|
iptables -I OUTPUT 1 -o "$TUN" -j ACCEPT
|
|
iptables -C FORWARD -i "$TUN" -j ACCEPT 2>/dev/null || \
|
|
iptables -I FORWARD 1 -i "$TUN" -j ACCEPT
|
|
fi
|