30 lines
1.1 KiB
Rust
30 lines
1.1 KiB
Rust
use crate::{config::Config, docker};
|
|
|
|
pub fn apply_firewall(cfg: &Config) -> anyhow::Result<()> {
|
|
let target = docker::discover_target(cfg)?;
|
|
|
|
if !cfg.anti_torrent.enabled {
|
|
let _ = docker::run_capture(&[
|
|
"docker",
|
|
"exec",
|
|
&target.container_name,
|
|
"sh",
|
|
"-c",
|
|
"nft delete table inet awg2_harness 2>/dev/null || true",
|
|
])?;
|
|
return Ok(());
|
|
}
|
|
|
|
let rule = format!(
|
|
"nft 'add table inet awg2_harness' 2>/dev/null || true; \
|
|
nft 'add chain inet awg2_harness forward_antitorrent {{ type filter hook forward priority filter; policy accept; }}' 2>/dev/null || true; \
|
|
nft 'flush chain inet awg2_harness forward_antitorrent'; \
|
|
nft 'add rule inet awg2_harness forward_antitorrent ip saddr {cidr} ct state new meter awg2_peer_connlimit_v4 {{ ip saddr ct count over {max} }} counter name antitorrent_dropped_v4 drop'",
|
|
cidr = cfg.anti_torrent.peer_ipv4_cidr,
|
|
max = cfg.anti_torrent.max_connections_per_peer
|
|
);
|
|
let _ = docker::run_capture(&["docker", "exec", &target.container_name, "sh", "-c", &rule])?;
|
|
Ok(())
|
|
}
|
|
|