diff --git a/ipfn b/ipfn index 956ffa8..92a12ef 100755 --- a/ipfn +++ b/ipfn @@ -1,8 +1,8 @@ #!/bin/bash # Name: ipfn -# Version: 1.2.4 +# Version: 1.2.6 # Date: 2026-01-22 -# Description: Enhanced for VM/LXD/Docker with bridge-nf tuning and robust forwarding. +# Description: Fixed 'local' variable error in main loop and improved port-test parsing. if [ "$(id -u)" -ne 0 ]; then exec sudo "$0" "$@" @@ -20,11 +20,9 @@ msg() { [[ "$QUIET_MODE" == false ]] && echo -e "$@"; } init_nft() { nft add table inet ${TABLE_NAME} 2>/dev/null - # NAT Chains nft add chain inet ${TABLE_NAME} prerouting { type nat hook prerouting priority -100 \; } 2>/dev/null nft add chain inet ${TABLE_NAME} output { type nat hook output priority -100 \; } 2>/dev/null nft add chain inet ${TABLE_NAME} postrouting { type nat hook postrouting priority 100 \; } 2>/dev/null - # Filter Chain (For VM/CT Forwarding) nft add chain inet ${TABLE_NAME} forward { type filter hook forward priority 0 \; policy accept \; } 2>/dev/null } @@ -33,7 +31,6 @@ enable_forwarding() { sysctl -w net.ipv4.ip_forward=1 >/dev/null sysctl -w net.ipv6.conf.all.forwarding=1 >/dev/null sysctl -w net.ipv4.conf.all.route_localnet=1 >/dev/null - # ブリッジパケットをNetfilterに渡す設定 (存在する場合のみ) sysctl -w net.bridge.bridge-nf-call-iptables=1 2>/dev/null sysctl -w net.bridge.bridge-nf-call-ip6tables=1 2>/dev/null msg "\e[32mForwarding and Bridge-NF enabled.\e[0m" @@ -42,19 +39,13 @@ enable_forwarding() { show_help() { echo "Usage: ipfn [OPTIONS] [RULES]" echo "" - echo "Rules Format:" - echo " 80:10.10.100.5:8080 Full (LocalPort:TargetIP:TargetPort)" - echo " 80:8080 IP defaults to 127.0.0.1" - echo " 11434 Map same port to 127.0.0.1" - echo "" echo "Options:" echo " -l, -L List all rules" - echo " -d HANDLE/:PORT/all Delete specific rules or '*' for all" + echo " -d HANDLE/:PORT/all Delete by handle, port (:80), or '*' for all" echo " -R Reset: Clear ALL rules immediately" - echo " -q Quiet mode (No output, Auto-yes)" - echo " -t [HANDLE] Test connectivity" + echo " -t [HANDLE / PORT:] Test connectivity (e.g., -t 33, -t 80: or -t :80)" echo " -f Enable IP forward & Bridge tuning / Skip test" - echo " -v Verbose (raw nftables output)" + echo " -q Quiet mode (No output, Auto-yes)" echo " -h Show this help" } @@ -90,7 +81,7 @@ test_rule_by_port() { fi } -# --- 2. Deletion Logic --- +# --- 2. Deletion & Reset --- validate_rule_handle() { nft -a list chain inet ${TABLE_NAME} prerouting | grep "handle $1" | grep -q "dnat" @@ -135,7 +126,6 @@ add_rule() { init_nft local raw_input=$1 local lp tip tp - if [[ "$raw_input" =~ ^([0-9]+):([0-9\.]+):([0-9]+)$ ]]; then lp=${BASH_REMATCH[1]}; tip=${BASH_REMATCH[2]}; tp=${BASH_REMATCH[3]} elif [[ "$raw_input" =~ ^([0-9]+):([0-9]+)$ ]]; then @@ -145,23 +135,15 @@ add_rule() { else msg "\e[31mError: Invalid rule format '$raw_input'\e[0m"; exit 1 fi - local raw_uuid=$(cat /proc/sys/kernel/random/uuid) local uuid="ipf-id:$raw_uuid" local family="ip"; [[ "$tip" =~ : ]] && family="ip6" - - # DNAT nft add rule inet ${TABLE_NAME} prerouting "$PROTO" dport "$lp" dnat $family to "$tip:$tp" comment "\"$uuid\"" nft add rule inet ${TABLE_NAME} output "$PROTO" dport "$lp" dnat $family to "$tip:$tp" comment "\"$uuid\"" - - # FORWARD (VM/CT対応) nft add rule inet ${TABLE_NAME} forward $family daddr "$tip" "$PROTO" dport "$tp" ct state new,established,related accept comment "\"$uuid\"" nft add rule inet ${TABLE_NAME} forward $family saddr "$tip" "$PROTO" sport "$tp" ct state established,related accept comment "\"$uuid\"" nft add rule inet ${TABLE_NAME} forward iifname "lo" accept comment "\"$uuid\"" - - # POSTROUTING (MASQUERADE: 戻りパケットの保証) nft add rule inet ${TABLE_NAME} postrouting $family daddr "$tip" "$PROTO" dport "$tp" masquerade comment "\"$uuid\"" - list_rules "$raw_uuid" [[ "$SKIP_TEST" == false ]] && { echo ""; test_rule_by_port "$lp"; } } @@ -175,7 +157,6 @@ for arg in "$@"; do done if [[ "$RESET_MODE" == true ]]; then all_clear; fi - if [[ $# -eq 0 ]]; then list_rules; exit 0; fi while [[ $# -gt 0 ]]; do @@ -183,37 +164,23 @@ while [[ $# -gt 0 ]]; do -h|--help) show_help; exit 0 ;; -v|--verbose) nft list table inet ${TABLE_NAME}; exit 0 ;; -L|-l) list_rules; exit 0 ;; - -f) - enable_forwarding - [[ $# -eq 1 ]] && exit 0 ;; - -t*) + -f) enable_forwarding; [[ $# -eq 1 ]] && exit 0 ;; + -t*) h_str="${1#-t}" - # 引数が空で、次に引数がある場合 (例: -t 80:) if [[ -z "$h_str" && -n "$2" ]]; then h_str="$2"; shift; fi - - local target_port="" - - if [[ "$h_str" =~ ^([0-9]+):$ ]]; then - # パターン: -t 80: (ポート直接指定) + target_port="" # 'local' は削除 + if [[ "$h_str" =~ ^:?([0-9]+):?$ ]]; then + # -t :80, -t 80:, -t 80 のいずれもポート指定として拾う target_port="${BASH_REMATCH[1]}" elif [[ -n "$h_str" ]]; then - # パターン: -t 33 (ハンドル指定) target_port=$(nft -a list chain inet ${TABLE_NAME} prerouting | grep "handle $h_str" | grep -o 'dport [0-9]*' | awk '{print $2}') else - # パターン: -t (引数なし、自動選択) count=$(nft list chain inet ${TABLE_NAME} prerouting | grep -c "dnat") if [ "$count" -eq 1 ]; then target_port=$(nft -a list chain inet ${TABLE_NAME} prerouting | grep "dnat" | grep -o 'dport [0-9]*' | awk '{print $2}') - else - msg "Error: Multiple rules exist. Use -t [HANDLE] or -t [PORT]:"; exit 1 fi fi - - if [[ -n "$target_port" ]]; then - test_rule_by_port "$target_port" - else - msg "Error: Could not identify port for test." - fi + [[ -n "$target_port" ]] && test_rule_by_port "$target_port" || msg "Error: Port/Handle not found." exit 0 ;; -*[d]*) h_str=$(echo "$1" | sed -E 's/^-q?d?f?//') @@ -241,11 +208,8 @@ while [[ $# -gt 0 ]]; do done list_rules; exit 0 ;; *) - if [[ "$1" =~ ^[0-9] ]]; then - add_rule "$1"; exit 0 - else - msg "\e[31mError: Unknown option '$1'\e[0m\n"; show_help; exit 1 - fi ;; + if [[ "$1" =~ ^[0-9] ]]; then add_rule "$1"; exit 0 + else msg "\e[31mError: Unknown option '$1'\e[0m\n"; show_help; exit 1; fi ;; esac shift done