32 lines
885 B
Bash
32 lines
885 B
Bash
#!/bin/bash
|
|
#
|
|
# Purpose : Turn on the ufw firewall. Incoming connections are blocked except
|
|
# for the services CoreDesktop runs, and ufw-docker stops ports
|
|
# published by Docker containers from getting around the firewall.
|
|
|
|
set -e
|
|
|
|
source "$HOME/.local/share/coredesktop/utils.sh"
|
|
|
|
install_packages ufw ufw-docker
|
|
|
|
sudo ufw default deny incoming
|
|
sudo ufw default allow outgoing
|
|
|
|
sudo ufw allow 22/tcp comment 'SSH'
|
|
sudo ufw allow 5353/udp comment 'mDNS'
|
|
sudo ufw allow 53317 comment 'LocalSend'
|
|
sudo ufw allow in on tailscale0 comment 'Tailscale'
|
|
|
|
sudo ufw --force enable
|
|
sudo systemctl enable ufw.service
|
|
|
|
# ufw-docker only installs its rules while ufw is active, and they take effect
|
|
# once ufw restarts
|
|
if ! sudo grep -q 'BEGIN UFW AND DOCKER' /etc/ufw/after.rules; then
|
|
sudo ufw-docker install
|
|
sudo systemctl restart ufw.service
|
|
fi
|
|
|
|
sudo ufw status verbose
|