-t

ipfn

@@ -1,8 +1,8 @@
 #!/bin/bash
 # Name: ipfn
-# Version: 1.2.4
+# Version: 1.2.6
 # Date: 2026-01-22
-# Description: Enhanced for VM/LXD/Docker with bridge-nf tuning and robust forwarding.
+# Description: Fixed 'local' variable error in main loop and improved port-test parsing.
 
 if [ "$(id -u)" -ne 0 ]; then
     exec sudo "$0" "$@"
@@ -20,11 +20,9 @@ msg() { [[ "$QUIET_MODE" == false ]] && echo -e "$@"; }
 
 init_nft() {
     nft add table inet ${TABLE_NAME} 2>/dev/null
-    # NAT Chains
     nft add chain inet ${TABLE_NAME} prerouting { type nat hook prerouting priority -100 \; } 2>/dev/null
     nft add chain inet ${TABLE_NAME} output { type nat hook output priority -100 \; } 2>/dev/null
     nft add chain inet ${TABLE_NAME} postrouting { type nat hook postrouting priority 100 \; } 2>/dev/null
-    # Filter Chain (For VM/CT Forwarding)
     nft add chain inet ${TABLE_NAME} forward { type filter hook forward priority 0 \; policy accept \; } 2>/dev/null
 }
 
@@ -33,7 +31,6 @@ enable_forwarding() {
     sysctl -w net.ipv4.ip_forward=1 >/dev/null
     sysctl -w net.ipv6.conf.all.forwarding=1 >/dev/null
     sysctl -w net.ipv4.conf.all.route_localnet=1 >/dev/null
-    # ブリッジパケットをNetfilterに渡す設定 (存在する場合のみ)
     sysctl -w net.bridge.bridge-nf-call-iptables=1 2>/dev/null
     sysctl -w net.bridge.bridge-nf-call-ip6tables=1 2>/dev/null
     msg "\e[32mForwarding and Bridge-NF enabled.\e[0m"
@@ -42,19 +39,13 @@ enable_forwarding() {
 show_help() {
     echo "Usage: ipfn [OPTIONS] [RULES]"
     echo ""
-    echo "Rules Format:"
-    echo "  80:10.10.100.5:8080   Full (LocalPort:TargetIP:TargetPort)"
-    echo "  80:8080               IP defaults to 127.0.0.1"
-    echo "  11434                 Map same port to 127.0.0.1"
-    echo ""
     echo "Options:"
     echo "  -l, -L                List all rules"
-    echo "  -d HANDLE/:PORT/all   Delete specific rules or '*' for all"
+    echo "  -d HANDLE/:PORT/all   Delete by handle, port (:80), or '*' for all"
     echo "  -R                    Reset: Clear ALL rules immediately"
-    echo "  -q                    Quiet mode (No output, Auto-yes)"
+    echo "  -t [HANDLE / PORT:]   Test connectivity (e.g., -t 33, -t 80: or -t :80)"
-    echo "  -t [HANDLE]           Test connectivity"
     echo "  -f                    Enable IP forward & Bridge tuning / Skip test"
-    echo "  -v                    Verbose (raw nftables output)"
+    echo "  -q                    Quiet mode (No output, Auto-yes)"
     echo "  -h                    Show this help"
 }
 
@@ -90,7 +81,7 @@ test_rule_by_port() {
     fi
 }
 
-# --- 2. Deletion Logic ---
+# --- 2. Deletion & Reset ---
 
 validate_rule_handle() {
     nft -a list chain inet ${TABLE_NAME} prerouting | grep "handle $1" | grep -q "dnat"
@@ -135,7 +126,6 @@ add_rule() {
     init_nft
     local raw_input=$1
     local lp tip tp
-
     if [[ "$raw_input" =~ ^([0-9]+):([0-9\.]+):([0-9]+)$ ]]; then
         lp=${BASH_REMATCH[1]}; tip=${BASH_REMATCH[2]}; tp=${BASH_REMATCH[3]}
     elif [[ "$raw_input" =~ ^([0-9]+):([0-9]+)$ ]]; then
@@ -145,23 +135,15 @@ add_rule() {
     else
         msg "\e[31mError: Invalid rule format '$raw_input'\e[0m"; exit 1
     fi
-
     local raw_uuid=$(cat /proc/sys/kernel/random/uuid)
     local uuid="ipf-id:$raw_uuid"
     local family="ip"; [[ "$tip" =~ : ]] && family="ip6"
-
-    # DNAT
     nft add rule inet ${TABLE_NAME} prerouting "$PROTO" dport "$lp" dnat $family to "$tip:$tp" comment "\"$uuid\""
     nft add rule inet ${TABLE_NAME} output "$PROTO" dport "$lp" dnat $family to "$tip:$tp" comment "\"$uuid\""
-    
-    # FORWARD (VM/CT対応)
     nft add rule inet ${TABLE_NAME} forward $family daddr "$tip" "$PROTO" dport "$tp" ct state new,established,related accept comment "\"$uuid\""
     nft add rule inet ${TABLE_NAME} forward $family saddr "$tip" "$PROTO" sport "$tp" ct state established,related accept comment "\"$uuid\""
     nft add rule inet ${TABLE_NAME} forward iifname "lo" accept comment "\"$uuid\""
-    
-    # POSTROUTING (MASQUERADE: 戻りパケットの保証)
     nft add rule inet ${TABLE_NAME} postrouting $family daddr "$tip" "$PROTO" dport "$tp" masquerade comment "\"$uuid\""
-    
     list_rules "$raw_uuid"
     [[ "$SKIP_TEST" == false ]] && { echo ""; test_rule_by_port "$lp"; }
 }
@@ -175,7 +157,6 @@ for arg in "$@"; do
 done
 
 if [[ "$RESET_MODE" == true ]]; then all_clear; fi
-
 if [[ $# -eq 0 ]]; then list_rules; exit 0; fi
 
 while [[ $# -gt 0 ]]; do
@@ -183,37 +164,23 @@ while [[ $# -gt 0 ]]; do
         -h|--help) show_help; exit 0 ;;
         -v|--verbose) nft list table inet ${TABLE_NAME}; exit 0 ;;
         -L|-l) list_rules; exit 0 ;;
-        -f)
+        -f) enable_forwarding; [[ $# -eq 1 ]] && exit 0 ;;
-            enable_forwarding
-            [[ $# -eq 1 ]] && exit 0 ;;
         -t*)
             h_str="${1#-t}"
-            # 引数が空で、次に引数がある場合 (例: -t 80:)
             if [[ -z "$h_str" && -n "$2" ]]; then h_str="$2"; shift; fi
-            
+            target_port="" # 'local' は削除
-            local target_port=""
+            if [[ "$h_str" =~ ^:?([0-9]+):?$ ]]; then
-
+                # -t :80, -t 80:, -t 80 のいずれもポート指定として拾う
-            if [[ "$h_str" =~ ^([0-9]+):$ ]]; then
-                # パターン: -t 80: (ポート直接指定)
                 target_port="${BASH_REMATCH[1]}"
             elif [[ -n "$h_str" ]]; then
-                # パターン: -t 33 (ハンドル指定)
                 target_port=$(nft -a list chain inet ${TABLE_NAME} prerouting | grep "handle $h_str" | grep -o 'dport [0-9]*' | awk '{print $2}')
             else
-                # パターン: -t (引数なし、自動選択)
                 count=$(nft list chain inet ${TABLE_NAME} prerouting | grep -c "dnat")
                 if [ "$count" -eq 1 ]; then
                     target_port=$(nft -a list chain inet ${TABLE_NAME} prerouting | grep "dnat" | grep -o 'dport [0-9]*' | awk '{print $2}')
-                else
-                    msg "Error: Multiple rules exist. Use -t [HANDLE] or -t [PORT]:"; exit 1
                 fi
             fi
-
+            [[ -n "$target_port" ]] && test_rule_by_port "$target_port" || msg "Error: Port/Handle not found."
-            if [[ -n "$target_port" ]]; then
-                test_rule_by_port "$target_port"
-            else
-                msg "Error: Could not identify port for test."
-            fi
             exit 0 ;;
         -*[d]*)
             h_str=$(echo "$1" | sed -E 's/^-q?d?f?//')
@@ -241,11 +208,8 @@ while [[ $# -gt 0 ]]; do
             done
             list_rules; exit 0 ;;
         *)
-            if [[ "$1" =~ ^[0-9] ]]; then
+            if [[ "$1" =~ ^[0-9] ]]; then add_rule "$1"; exit 0
-                add_rule "$1"; exit 0
+            else msg "\e[31mError: Unknown option '$1'\e[0m\n"; show_help; exit 1; fi ;;
-            else
-                msg "\e[31mError: Unknown option '$1'\e[0m\n"; show_help; exit 1
-            fi ;;
     esac
     shift
 done