1
sudo tee /usr/local/bin/deploy_firewall.sh >/dev/null <<'EOF'
2
#!/bin/bash
3
# ============================================================================
4
# 部署防火墙规则，本脚本只需执行一次
5
# 无 P2P 版
6
# 修改配置后重新执行即可，脚本会自动覆盖旧规则
7
# ============================================================================
8

9
# ===================== 用户配置区 =====================
10

11
SSH_PORT=54321
12

13
# Web 端口（80 用于 HTTP，443 用于 HTTPS）
14
# 如需放行其他端口请在此添加
15
WEB_PORTS=(80 443)
16

17
# 是否启用 IPv6（1=启用，0=禁用）
18
ENABLE_IPV6=1
19

20
# 邻居网段全局阻断（设为 "-" 表示不启用）
21
# 示例: NEIGHBOR_V4="10.0.0.0/8"
22
NEIGHBOR_V4="<YOUR_NEIGHBOR_V4_CIDR>"
23
NEIGHBOR_V6="<YOUR_NEIGHBOR_V6_CIDR>"
24

25

26
export PATH="/usr/sbin:/sbin:$PATH"
27

28
# ===================== 日志与颜色 =====================
29

30
RED='\033[1;31m'
31
GREEN='\033[1;32m'
32
YELLOW='\033[1;33m'
33
BLUE='\033[1;34m'
34
CYAN='\033[1;36m'
35
NC='\033[0m'
36

37
log()  { echo -e "${BLUE}[INFO]${NC}  $1"; }
38
ok()   { echo -e "${GREEN}[OK]${NC}    $1"; }
39
warn() { echo -e "${YELLOW}[WARN]${NC}  $1"; }
40
err()  { echo -e "${RED}[ERR]${NC}   $1"; }
41
die()  { err "$1"; exit 1; }
42

43
# 检查 IPv6
44
check_v6() {
45
    if [ "$ENABLE_IPV6" != "1" ]; then echo 0; return; fi
46
    if [ -f /proc/net/if_inet6 ] && [ "$(wc -l < /proc/net/if_inet6)" -gt 0 ]; then
47
        command -v ip6tables &>/dev/null && echo 1 || echo 0
48
    else
49
        echo 0
50
    fi
51
}
52

53
# 依赖检查
54
check_deps() {
55
    local missing=()
56
    for cmd in ipset iptables; do
57
        command -v "$cmd" &>/dev/null || missing+=("$cmd")
58
    done
59
    if [ "${#missing[@]}" -gt 0 ]; then
60
        err "Missing dependencies: ${missing[*]}"
61
        err "Run: sudo apt install -y ipset iptables"
62
        exit 1
63
    fi
64
    ok "Dependencies satisfied"
65

66
    if [ "$HAS_V6" = "1" ] && ! command -v ip6tables &>/dev/null; then
67
        warn "ip6tables not found, disabling IPv6"
68
        HAS_V6=0
69
    fi
70
}
71

72
# 安装 iptables-persistent 与 ipset-persistent
73
install_persistent() {
74
    if dpkg -l iptables-persistent 2>/dev/null | grep -q '^ii' && dpkg -l ipset-persistent 2>/dev/null | grep -q '^ii'; then
75
        return 0
76
    fi
77
    log "Installing iptables-persistent & ipset-persistent..."
78
    echo iptables-persistent iptables-persistent/autosave_v4 boolean true \
79
        | debconf-set-selections 2>/dev/null
80
    echo iptables-persistent iptables-persistent/autosave_v6 boolean true \
81
        | debconf-set-selections 2>/dev/null
82
    DEBIAN_FRONTEND=noninteractive apt-get install -y iptables-persistent ipset-persistent &>/dev/null \
83
        || warn "Could not install persistent packages, will fallback to manual save"
84
}
85

86
# 创建 ipset 集合
87
create_ipsets() {
88
    ipset create bad_asn_v4 hash:net family inet \
89
        hashsize 4096 maxelem 500000 -exist 2>/dev/null
90
    if [ "$HAS_V6" = "1" ]; then
91
        ipset create bad_asn_v6 hash:net family inet6 \
92
            hashsize 4096 maxelem 500000 -exist 2>/dev/null
93
    fi
94
    ok "ipset collections created"
95
}
96

97
# 部署 iptables 规则
98
deploy_v4() {
99
    iptables -P INPUT DROP
100
    iptables -P FORWARD DROP
101
    iptables -P OUTPUT ACCEPT
102

103
    iptables -F
104
    iptables -X
105

106
    # 基础放行
107
    iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
108
    iptables -A INPUT -i lo -j ACCEPT
109

110
    # 全局阻断邻居网段
111
    if [ "$NEIGHBOR_V4" != "-" ]; then
112
        iptables -A INPUT -s "$NEIGHBOR_V4" -j DROP
113
        ok "Neighbor v4 blocked globally: $NEIGHBOR_V4"
114
    fi
115

116
    # 全局阻断 ASN 黑名单
117
    iptables -A INPUT -m set --match-set bad_asn_v4 src -j DROP
118
    ok "Global blacklist: DROP(ASN)"
119

120
    # SSH
121
    iptables -A INPUT -p tcp --dport "$SSH_PORT" -j ACCEPT
122
    ok "Allow TCP port $SSH_PORT (SSH)"
123

124
    # Web (80, 443)
125
    for port in "${WEB_PORTS[@]}"; do
126
        iptables -A INPUT -p tcp --dport "$port" -j ACCEPT
127
        ok "Allow TCP port $port (Web)"
128
    done
129
}
130

131
# 部署 ip6tables 规则
132
deploy_v6() {
133
    ip6tables -P INPUT DROP
134
    ip6tables -P FORWARD DROP
135
    ip6tables -P OUTPUT ACCEPT
136

137
    ip6tables -F
138
    ip6tables -X
139

140
    ip6tables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
141
    ip6tables -A INPUT -i lo -j ACCEPT
142

143
    # 全局阻断 邻居网段
144
    if [ "$NEIGHBOR_V6" != "-" ]; then
145
        ip6tables -A INPUT -s "$NEIGHBOR_V6" -j DROP
146
        ok "Neighbor v6 blocked globally: $NEIGHBOR_V6"
147
    fi
148

149
    # 全局阻断 ASN 黑名单
150
    ip6tables -A INPUT -m set --match-set bad_asn_v6 src -j DROP
151
    ok "Global blacklist: DROP(ASN)"
152

153
    # SSH
154
    ip6tables -A INPUT -p tcp --dport "$SSH_PORT" -j ACCEPT
155

156
    # Web (80, 443)
157
    for port in "${WEB_PORTS[@]}"; do
158
        ip6tables -A INPUT -p tcp --dport "$port" -j ACCEPT
159
    done
160
}
161

162
# 持久化
163
persist() {
164
    if command -v netfilter-persistent &>/dev/null; then
165
        netfilter-persistent save 2>/dev/null
166
        ok "Rules saved via netfilter-persistent"
167
    else
168
        mkdir -p /etc/iptables
169
        ipset save > /etc/iptables/ipsets 2>/dev/null
170
        iptables-save > /etc/iptables/rules.v4
171
        [ "$HAS_V6" = "1" ] && ip6tables-save > /etc/iptables/rules.v6
172
        ok "Rules saved to /etc/iptables/"
173
        warn "Consider installing iptables-persistent for automatic restore on boot"
174
    fi
175
}
176

177
print_rules() {
178
    echo ""
179
    echo -e "${CYAN}=== IPv4 INPUT Rules ===${NC}"
180
    iptables -L INPUT -v -n --line-numbers 2>/dev/null | head -20
181
    if [ "$HAS_V6" = "1" ]; then
182
        echo ""
183
        echo -e "${CYAN}=== IPv6 INPUT Rules ===${NC}"
184
        ip6tables -L INPUT -v -n --line-numbers 2>/dev/null | head -15
185
    fi
186
}
187

188
# 主流程
189
main() {
190
    if [ "$(id -u)" != "0" ]; then
191
        die "This script must be run as root"
192
    fi
193

194
    echo ""
195
    echo -e "${CYAN}========================================${NC}"
196
    echo -e "${GREEN}  Firewall Deployment (One-Time Setup)${NC}"
197
    echo -e "${CYAN}========================================${NC}"
198
    echo ""
199

200
    HAS_V6=$(check_v6)
201
    [ "$HAS_V6" = "1" ] && ok "IPv6 enabled" || warn "IPv6 disabled"
202

203
    check_deps
204
    create_ipsets
205

206
    echo ""
207
    log "Deploying IPv4 rules..."
208
    deploy_v4
209

210
    if [ "$HAS_V6" = "1" ]; then
211
        echo ""
212
        log "Deploying IPv6 rules..."
213
        deploy_v6
214
    fi
215

216
    echo ""
217
    log "Persisting rules..."
218
    install_persistent
219
    persist
220

221
    print_rules
222

223
    echo ""
224
    echo -e "${GREEN}Firewall deployed.${NC}"
225
    echo -e "${YELLOW}Next: run update_blacklists.sh to load ASN blacklists.${NC}"
226
    echo ""
227
}
228

229
main "$@"
230
EOF

1
sudo tee /usr/local/bin/update_blacklists.sh >/dev/null <<'EOF'
2
#!/bin/bash
3
# ============================================================================
4
# 更新 ASN 黑名单
5
# ============================================================================
6

7
# 需要屏蔽的 ASN（格式：ASN|名称）
8
ASNS=(
9
    "14061|DigitalOcean"
10
    "16509|AWS"
11
    "15169|Google_Cloud"
12
    "8075|Azure"
13
    "20473|Vultr"
14
    "31898|Oracle"
15
)
16

17
# 缓存目录
18
CACHE_DIR="/var/lib/seedbox-firewall"
19

20
export PATH="/usr/sbin:/sbin:$PATH"
21
set -o pipefail
22

23
# ===================== 日志与颜色 =====================
24

25
RED='\033[1;31m'
26
GREEN='\033[1;32m'
27
YELLOW='\033[1;33m'
28
BLUE='\033[1;34m'
29
CYAN='\033[1;36m'
30
NC='\033[0m'
31

32
log()  { echo -e "${BLUE}[INFO]${NC}  $1"; }
33
ok()   { echo -e "${GREEN}[OK]${NC}    $1"; }
34
warn() { echo -e "${YELLOW}[WARN]${NC}  $1"; }
35
err()  { echo -e "${RED}[ERR]${NC}   $1"; }
36
die()  { err "$1"; exit 1; }
37
ln()   { echo "------------------------------"; }
38
fmt()  { printf "%'d" "$1"; }
39

40
# 检查 IPv6
41
check_v6() {
42
    if [ -f /proc/net/if_inet6 ] && [ "$(wc -l < /proc/net/if_inet6)" -gt 0 ]; then
43
        command -v ip6tables &>/dev/null && echo 1 || echo 0
44
    else
45
        echo 0
46
    fi
47
}
48

49
# 依赖检查
50
check_deps() {
51
    local missing=()
52
    for cmd in curl awk python3 ipset whois sha256sum; do
53
        command -v "$cmd" &>/dev/null || missing+=("$cmd")
54
    done
55
    if [ "${#missing[@]}" -gt 0 ]; then
56
        die "Missing: ${missing[*]}. Run: sudo apt install -y curl gawk python3 ipset iproute2 whois"
57
    fi
58

59
    # 检查 ASN ipset 是否存在（由 deploy_firewall.sh 创建）
60
    if ! ipset list bad_asn_v4 &>/dev/null; then
61
        die "ipset 'bad_asn_v4' not found. Run deploy_firewall.sh first."
62
    fi
63
}
64

65
# ===================== 缓存函数 =====================
66

67
init_cache() {
68
    mkdir -p "$CACHE_DIR" 2>/dev/null || { die "Cannot create $CACHE_DIR"; }
69
}
70

71
get_cached_hash() {
72
    local name="$1"
73
    local hashfile="${CACHE_DIR}/${name}.sha256"
74
    [ -f "$hashfile" ] && cat "$hashfile" || echo ""
75
}
76

77
set_cached_hash() {
78
    local name="$1" hash="$2"
79
    echo "$hash" > "${CACHE_DIR}/${name}.sha256"
80
}
81

82
is_changed() {
83
    local name="$1" cidr_file="$2"
84
    if [ ! -s "$cidr_file" ]; then
85
        return 0  # 空文件视为有变化（或错误）
86
    fi
87
    local new_hash=$(sha256sum "$cidr_file" | awk '{print $1}')
88
    local old_hash=$(get_cached_hash "$name")
89
    if [ "$new_hash" = "$old_hash" ] && [ -n "$old_hash" ]; then
90
        return 1  # 未变化
91
    fi
92
    return 0  # 有变化
93
}
94

95
update_cache() {
96
    local name="$1" cidr_file="$2"
97
    local new_hash=$(sha256sum "$cidr_file" | awk '{print $1}')
98
    set_cached_hash "$name" "$new_hash"
99
}
100

101
# ===================== ASN 更新 =====================
102

103
update_asn() {
104
    log "Fetching ASN routes from RADb..."
105

106
    local work="/tmp/asn-update-$$"
107
    mkdir -p "$work"
108
    local v4_cidr="${CACHE_DIR}/asn_v4.cidr"
109
    local v6_cidr="${CACHE_DIR}/asn_v6.cidr"
110
    local v4_tmp="${work}/asn_v4.cidr"
111
    local v6_tmp="${work}/asn_v6.cidr"
112

113
    true > "$v4_tmp"
114
    [ "$HAS_V6" = "1" ] && true > "$v6_tmp"
115

116
    local v4_total=0 v6_total=0
117

118
    for ITEM in "${ASNS[@]}"; do
119
        ASN="${ITEM%%|*}"
120
        NAME="${ITEM##*|}"
121

122
        local whois_out="${work}/whois_${ASN}.txt"
123
        if ! timeout 20 whois -h whois.radb.net -- "-i origin AS${ASN}" > "$whois_out" 2>/dev/null; then
124
            warn "AS${ASN} ${NAME}: whois timeout or failed"
125
            rm -f "$whois_out"
126
            continue
127
        fi
128

129
        # 提取 v4 路由
130
        local v4_count=$(awk '/^route:/ {print $2}' "$whois_out" | grep -v '^$' | tee -a "$v4_tmp" | wc -l)
131
        v4_total=$((v4_total + v4_count))
132

133
        if [ "$HAS_V6" = "1" ]; then
134
            local v6_count=$(awk '/^route6:/ {print $2}' "$whois_out" | grep -v '^$' | tee -a "$v6_tmp" | wc -l)
135
            v6_total=$((v6_total + v6_count))
136
        fi
137

138
        log "  AS${ASN} ${NAME}: v4=${v4_count} v6=${HAS_V6:+"$v6_count"}"
139
        rm -f "$whois_out"
140
    done
141

142
    # 更新 v4
143
    local v4_updated=0
144
    if [ "$v4_total" -lt 50 ]; then
145
        warn "ASN v4 too few entries ($v4_total), keeping existing set"
146
    elif is_changed "asn_v4" "$v4_tmp"; then
147
        log "ASN v4 changed, swapping ipset..."
148
        local new_set="bad_asn_v4_new"
149
        ipset create "$new_set" hash:net family inet hashsize 4096 maxelem 500000 -exist 2>/dev/null
150
        {
151
            echo "create $new_set hash:net family inet hashsize 4096 maxelem 500000 -exist"
152
            awk '{print "add '"$new_set"' " $0}' "$v4_tmp"
153
        } | ipset restore -exist 2>/dev/null
154
        ipset swap "$new_set" bad_asn_v4
155
        ipset destroy "$new_set" 2>/dev/null
156
        cp "$v4_tmp" "$v4_cidr"
157
        update_cache "asn_v4" "$v4_tmp"
158
        v4_updated=1
159
        ok "ASN v4 updated: $(fmt $(wc -l < "$v4_cidr")) entries"
160
    else
161
        ok "ASN v4 unchanged ($(fmt $v4_total) entries), skipped"
162
    fi
163

164
    # 更新 v6
165
    if [ "$HAS_V6" = "1" ]; then
166
        if [ "$v6_total" -lt 50 ]; then
167
            warn "ASN v6 too few entries ($v6_total), keeping existing set"
168
        elif is_changed "asn_v6" "$v6_tmp"; then
169
            log "ASN v6 changed, swapping ipset..."
170
            local new_set="bad_asn_v6_new"
171
            ipset create "$new_set" hash:net family inet6 hashsize 4096 maxelem 500000 -exist 2>/dev/null
172
            {
173
                echo "create $new_set hash:net family inet6 hashsize 4096 maxelem 500000 -exist"
174
                awk '{print "add '"$new_set"' " $0}' "$v6_tmp"
175
            } | ipset restore -exist 2>/dev/null
176
            ipset swap "$new_set" bad_asn_v6
177
            ipset destroy "$new_set" 2>/dev/null
178
            cp "$v6_tmp" "$v6_cidr"
179
            update_cache "asn_v6" "$v6_tmp"
180
            ok "ASN v6 updated: $(fmt $(wc -l < "$v6_cidr")) entries"
181
        else
182
            ok "ASN v6 unchanged ($(fmt $v6_total) entries), skipped"
183
        fi
184
    fi
185

186
    rm -rf "$work"
187
}
188

189
# ===================== 打印统计 =====================
190

191
print_summary() {
192
    echo ""
193
    ln
194
    local asn_v4=$(ipset list bad_asn_v4 2>/dev/null | grep "Number of entries" | awk '{print $NF}')
195
    echo "  ASN v4:  ${asn_v4:-0} entries"
196
    if [ "$HAS_V6" = "1" ]; then
197
        local asn_v6=$(ipset list bad_asn_v6 2>/dev/null | grep "Number of entries" | awk '{print $NF}')
198
        echo "  ASN v6:  ${asn_v6:-0} entries"
199
    fi
200
    ln
201
}
202

203
# ===================== 主流程 =====================
204

205
main() {
206
    if [ "$(id -u)" != "0" ]; then
207
        die "This script must be run as root"
208
    fi
209

210
    echo ""
211
    echo -e "${CYAN}========================================${NC}"
212
    echo -e "${GREEN}  ASN Blacklist Update${NC}"
213
    echo -e "${CYAN}========================================${NC}"
214
    echo ""
215

216
    HAS_V6=$(check_v6)
217
    [ "$HAS_V6" = "1" ] && ok "IPv6 enabled" || warn "IPv6 disabled"
218

219
    check_deps
220
    init_cache
221

222
    echo ""
223
    log "Updating ASN blacklists..."
224
    update_asn
225

226
    print_summary
227

228
    echo -e "${GREEN}ASN blacklist update complete.${NC}"
229
    echo ""
230
}
231

232
main "$@"
233
EOF