dsh-vpn 0.1.2 → 0.1.4

package/README.md

@@ -1,6 +1,17 @@
 # dsh-vpn
 
-[DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) 插件：在 dsh 里填好 VPS 的 IP、端口、用户名和密码，一键部署 sing-box，然后扫二维码导入代理客户端。
+[DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) 插件：在**你自己的 VPS** 上一键部署加密的 VPN 服务，保护你的网络连接安全。在 dsh 里填好 VPS 的 IP、端口、用户名和密码，一键部署 sing-box，然后扫二维码导入手机或电脑上的客户端。
+
+## 用途：保护你的网络安全
+
+- **加密你的网络流量。** 在公共 Wi-Fi（咖啡馆、机场、酒店）等不可信网络上，你设备和服务器之间的全部流量都经过加密，别人无法窃听或篡改。
+- **保护隐私。** 同一网络上的其他人和网络运营方看不到你访问的内容。
+- **服务器由你自己掌控。** 服务部署在你自己的 VPS 上，不经过任何第三方 VPN 服务商，数据只在你的设备和你的服务器之间传输。
+- **默认安全的配置。** 协议之间的密钥各自独立、随机生成；推荐的 IP 证书让客户端正常校验服务器身份，防止中间人攻击。
+
+请在遵守所在地法律法规和服务器提供商服务条款的前提下使用。
+
+## 特性
 
 - **不依赖本机的 ssh 命令**：内置纯 JS 的 SSH 客户端（[ssh2](https://github.com/mscdex/ssh2)），用密码登录。
 - **两种用法**：在设置页点按钮，或者直接对 agent 说“帮我装个节点”。
@@ -25,7 +36,24 @@ dsh plugin --profile web add dsh-vpn
 1. 填写服务器 IP、SSH 端口、用户名、密码，点「保存」和「测试连接」。
 2. 勾选要安装的协议，选择证书类型（推荐「IP 证书」），保存后点「安装 / 更新」。
 3. 在「节点二维码」里点「刷新二维码」，用手机或电脑上的客户端扫码导入。
-4. 在云服务商控制台的安全组里放行页面提示的端口。用 IP 证书时，TCP 80 端口要一直开放，用于续期。
+4. 服务器防火墙的端口由插件自动放行，不用手动操作；安装完成后提示框会列出放行了哪些端口。
+
+## 防火墙
+
+安装时插件会检测 VPS 上启用的防火墙，自动放行所选协议的端口（使用 IP 证书时还有 TCP 80）：
+
+| 防火墙 | 做法 |
+|---|---|
+| ufw | `ufw allow` |
+| firewalld | 放行端口（永久规则和运行时规则都加） |
+| iptables（如 Oracle Cloud 镜像自带的 REJECT 规则） | 在 INPUT 链最前面插入放行规则，带 `dsh-vpn` 标签 |
+| nftables（原生规则集） | 在各个 input 链插入放行规则，带 `dsh-vpn` 标签 |
+| 没有启用防火墙 | 不做任何改动 |
+
+- 规则写在 `/etc/dsh-vpn/firewall.sh` 里，服务每次启动都会重新应用，所以 iptables/nftables 规则重启后也还在。
+- 重新安装时，先关闭上次放行的端口，再放行新的，所以取消勾选的协议端口会被关掉。卸载时会删除插件添加的所有规则。
+- 插件只添加和删除自己的规则，从不启用防火墙、修改默认策略或改动 SSH 端口。
+- **云服务商的安全组**（阿里云、腾讯云、AWS 等）在服务器外部，只能在服务商控制台修改，插件改不了；如果有安全组，仍需在控制台放行同样的端口。
 
 ## 证书
 
@@ -84,20 +112,18 @@ DSH_SRC=/path/to/deepseek-harness pnpm typecheck   # 对照 dsh 源码做宿主
 
 npm 上的 `@deepseek-ai/*` 包版本过旧，所以 `build` 不做类型检查，类型检查对照 dsh 源码单独进行。
 
-## 发布
-
-推送与 `package.json` 版本号一致的标签，GitHub Actions 会先跑测试，再发布到 npm。需要在仓库 Secrets 里配置 `NPM_TOKEN`。仓库是私有的，npm 不支持为私有仓库生成来源证明（provenance），所以发布时不带来源证明：
+端到端测试会在目标机器上**安装再卸载**，并用 sing-box 客户端实测每种协议的连通性。本地可以用 [Lima](https://lima-vm.io) 虚拟机：
 
 ```bash
-git tag v0.1.0 && git push origin v0.1.0
+limactl start --name=vps --vm-type=vz --network=vzNAT --set '.mounts=[]' template:ubuntu-24.04
+# 在虚拟机里开启 sshd 的密码登录并设置密码，然后：
+DSH_VPN_E2E_HOST=<测试虚拟机 IP> DSH_VPN_E2E_USER=root DSH_VPN_E2E_PASSWORD=… pnpm test:e2e
 ```
 
-端到端测试会在目标机器上**安装再卸载**，并用 sing-box 客户端实测每种协议的连通性。本地可以用 [Lima](https://lima-vm.io) 虚拟机：
+防火墙测试会依次启用 ufw、firewalld、iptables、nftables，**只能在测试虚拟机上运行**：
 
 ```bash
-limactl start --name=vps --vm-type=vz --network=vzNAT --set '.mounts=[]' template:ubuntu-24.04
-# 在虚拟机里开启 sshd 的密码登录并设置密码，然后：
-DSH_VPN_E2E_HOST=192.168.64.2 DSH_VPN_E2E_USER=root DSH_VPN_E2E_PASSWORD=… pnpm test:e2e
+DSH_VPN_E2E_FIREWALL=1 DSH_VPN_E2E_HOST=… DSH_VPN_E2E_USER=root DSH_VPN_E2E_PASSWORD=… pnpm test:e2e
 ```
 
 IP 证书的测试需要一个本地 ACME 服务器，用 Let's Encrypt 官方的 [Pebble](https://github.com/letsencrypt/pebble) 模拟。**只能在测试虚拟机上运行**，因为它会把 Pebble 的根证书加入系统信任：
@@ -109,6 +135,14 @@ DSH_VPN_E2E_ACME=https://localhost:14000/dir DSH_VPN_E2E_HOST=… pnpm test:e2e
 
 在插件配置里设置 `acmeProvider`，就可以让插件改用 Pebble 或其他 ACME 服务器。
 
+## 发布
+
+推送与 `package.json` 版本号一致的标签，GitHub Actions 会先跑测试，再发布到 npm。需要在仓库 Secrets 里配置 `NPM_TOKEN`。仓库是私有的，npm 不支持为私有仓库生成来源证明（provenance），所以发布时不带来源证明：
+
+```bash
+git tag v0.1.0 && git push origin v0.1.0
+```
+
 ## TODO
 
 - [ ] SSH 私钥登录
@@ -116,6 +150,6 @@ DSH_VPN_E2E_ACME=https://localhost:14000/dir DSH_VPN_E2E_HOST=… pnpm test:e2e
 - [ ] 可自定义 Reality 的 SNI、协议端口
 - [ ] 证书使用自己的域名（DNS 验证：Cloudflare / 阿里云）
 - [ ] IPv6 的 IP 证书（目前只在 IPv4 上验证过）
-- [ ] 支持 OpenRC（Alpine）和 iptables/nftables
+- [ ] 支持 OpenRC（Alpine）
 - [ ] 支持 GitHub 下载镜像
 - [ ] 在真实 VPS 上跑端到端测试（Debian 12 / Ubuntu 24.04 / Rocky 9）

package/assets/vpn-ops.md

@@ -1,6 +1,10 @@
 # vpn-ops
 
-Deploy and operate a personal sing-box server on the user's VPS. The plugin logs in over SSH with the password saved in dsh Settings (bottom-left gear) → VPN 设置. No local ssh client is needed.
+Deploy and operate a personal, encrypted VPN (sing-box) on the user's own VPS. The plugin logs in over SSH with the password saved in dsh Settings (bottom-left gear) → VPN 设置. No local ssh client is needed.
+
+## Purpose
+
+This is a security and privacy tool. It encrypts all traffic between the user's devices and a server they control, so connections stay private on untrusted networks such as public Wi-Fi, without relying on a third-party VPN provider. Describe it in those terms, and remind the user to use it in line with local laws and their server provider's terms of service.
 
 ## Workflow
 
@@ -9,7 +13,7 @@ Deploy and operate a personal sing-box server on the user's VPS. The plugin logs
    - Installed and active → offer `vpn_links` instead of reinstalling.
 2. **Install.** Call `vpn_install`. Omit `protocols` to use the selection saved in settings. Only pass `regenerate: true` when the user explicitly wants new keys, because every old link stops working.
 3. **Deliver.** Say the links are ready and that 设置 → VPN 设置 shows scannable QR codes (刷新二维码 button). Client apps: v2rayN, NekoBox, Shadowrocket, sing-box, Clash Meta / mihomo.
-4. **Remind** the user to open the reported ports in the cloud provider's security group, using the right transport for each protocol.
+4. **Firewall.** Install opens the ports in the VPS's own firewall automatically (ufw, firewalld, iptables or nftables; see `result.firewall`) and re-applies them after reboots. Don't ask the user to do that. Only mention that a cloud security group (Aliyun, Tencent Cloud, AWS…), which sits outside the server, may still need the same ports opened in the provider console.
 
 ## Certificates
 
@@ -19,11 +23,11 @@ The settings page offers **self-signed** (default) or **IP certificate** (recomm
 
 | id | Name | Transport | Notes |
 |---|---|---|---|
-| `reality` | VLESS Reality | TCP | Default. Hardest to detect. |
+| `reality` | VLESS Reality | TCP | Default. Strong encryption; the handshake looks like ordinary HTTPS to a well-known website, which keeps usage private. |
 | `hy2` | Hysteria2 | UDP | Default. Fast on lossy links; the link pins the certificate. |
 | `tuic` | TUIC v5 | UDP | With a self-signed cert, clients skip verification; with an IP certificate, they verify normally. |
 | `anytls` | AnyTLS | TCP | Same as TUIC. |
-| `ss` | Shadowsocks 2022 | TCP+UDP | Widely supported; no TLS disguise. |
+| `ss` | Shadowsocks 2022 | TCP+UDP | Widely supported, modern AEAD encryption, no TLS layer. |
 
 ## Troubleshooting
 
@@ -31,16 +35,16 @@ The settings page offers **self-signed** (default) or **IP certificate** (recomm
 |---|---|---|
 | `auth_failed` | Wrong username or password | User fixes it on the settings page |
 | `host_key_mismatch` | Server reinstalled or replaced, or a man-in-the-middle | Ask whether the server was reinstalled. Only then may the user click 重置指纹 (Reset fingerprint) |
-| `connect_failed` / `timeout` | Wrong IP or port, SSH blocked, server down | Check the IP and SSH port on the settings page |
+| `connect_failed` / `timeout` | Wrong IP or port, SSH not reachable, server down | Check the IP and SSH port on the settings page |
 | `sudo_failed` | User is not root and lacks sudo, or the sudo password differs | Use root, or grant sudo |
 | `no_systemd` | Container or OpenRC VPS | Not supported yet |
 | `download_failed` | VPS cannot reach GitHub | Retry later |
 | `cert_failed` | IP certificate not issued (usually port 80 closed). The node fell back to self-signed and still works | Open TCP 80 in the security group, then install again |
 | `port80_in_use` | Another program (nginx, …) holds port 80 | Stop it, or use self-signed |
 | Status says the certificate expires within 24 h or has expired | Renewal failing | Open TCP 80; an expired certificate breaks every TLS protocol |
-| Installed and active, but the client times out | Cloud security group or upstream firewall | Open the TCP/UDP ports in the cloud console |
-| Reality fails, others work | SNI site blocked | Reinstall with another SNI (future option) |
-| UDP protocols fail, TCP works | ISP blocks or throttles UDP | Use Reality or AnyTLS |
-| Everything stopped after working | IP blocked | `vpn_install` with `regenerate: true` for new ports; if it is still blocked, the IP must change |
+| Installed and active, but the client times out | Cloud security group (the VPS firewall is handled automatically) | Open the ports from `result.firewall.opened` in the cloud console |
+| Reality fails, others work | The Reality handshake site (SNI) is unreachable from the server | Reinstall with another SNI (future option) |
+| UDP protocols fail, TCP works | The current network drops or rate-limits UDP (common on some Wi-Fi and mobile networks) | Use Reality or AnyTLS |
+| Everything stopped after working | The server IP or its ports are no longer reachable from the user's network | `vpn_install` with `regenerate: true` for new ports; if it is still unreachable, check with the server provider |
 
 Never paste passwords, private keys or the state file into chat. Share links are secrets too: show them only to the user.

package/lib/client.js

@@ -63,7 +63,7 @@ var NS = "dsh-vpn";
 var zh = {
   title: "VPN \u8282\u70B9",
   nav: "VPN \u8BBE\u7F6E",
-  description: "\u5728\u4F60\u7684 VPS \u4E0A\u4E00\u952E\u90E8\u7F72 sing-box\uFF0C\u5E76\u7528\u4E8C\u7EF4\u7801\u5BFC\u5165\u624B\u673A\u6216\u7535\u8111\u4E0A\u7684\u4EE3\u7406\u5BA2\u6237\u7AEF\u3002",
+  description: "\u5728\u4F60\u81EA\u5DF1\u7684 VPS \u4E0A\u4E00\u952E\u90E8\u7F72\u52A0\u5BC6 VPN\uFF0C\u4FDD\u62A4\u4F60\u5728\u516C\u5171 Wi-Fi \u7B49\u7F51\u7EDC\u4E2D\u7684\u8FDE\u63A5\u5B89\u5168\u548C\u9690\u79C1\uFF1B\u626B\u7801\u5373\u53EF\u5BFC\u5165\u624B\u673A\u6216\u7535\u8111\u4E0A\u7684\u5BA2\u6237\u7AEF\u3002",
   serverSection: "\u670D\u52A1\u5668",
   host: "\u670D\u52A1\u5668 IP \u6216\u57DF\u540D",
   hostHint: "\u4F60\u8D2D\u4E70\u7684 VPS \u7684\u516C\u7F51\u5730\u5740\u3002",
@@ -124,7 +124,10 @@ var zh = {
   copy: "\u590D\u5236\u94FE\u63A5",
   copied: "\u5DF2\u590D\u5236",
   portLabel: "\u7AEF\u53E3 {port}",
-  cloudFirewall: "\u63D0\u9192\uFF1A\u8FD8\u9700\u8981\u5728\u4E91\u670D\u52A1\u5546\u63A7\u5236\u53F0\u7684\u5B89\u5168\u7EC4\u91CC\u653E\u884C\u4EE5\u4E0B\u7AEF\u53E3\uFF1A{ports}",
+  fwOpened: "\u5DF2\u81EA\u52A8\u5728\u670D\u52A1\u5668\u9632\u706B\u5899\uFF08{backend}\uFF09\u653E\u884C\u7AEF\u53E3\uFF1A{ports}\u3002",
+  fwNone: "\u670D\u52A1\u5668\u6CA1\u6709\u542F\u7528\u9632\u706B\u5899\uFF0C\u7AEF\u53E3\u65E0\u9700\u653E\u884C\u3002",
+  fwStatus: "\u670D\u52A1\u5668\u9632\u706B\u5899\uFF08{backend}\uFF09\u5DF2\u653E\u884C {count} \u4E2A\u7AEF\u53E3\uFF0C\u91CD\u542F\u540E\u81EA\u52A8\u6062\u590D\u3002",
+  cloudHint: "\u5982\u679C\u4E91\u670D\u52A1\u5546\u6709\u5B89\u5168\u7EC4\uFF08\u963F\u91CC\u4E91\u3001\u817E\u8BAF\u4E91\u3001AWS \u7B49\uFF09\uFF0C\u8FD9\u4E9B\u7AEF\u53E3\u8FD8\u9700\u5728\u5176\u63A7\u5236\u53F0\u653E\u884C\u3002",
   "err.not_configured": "\u8BF7\u5148\u586B\u5199\u5E76\u4FDD\u5B58\u670D\u52A1\u5668\u4FE1\u606F\u3002",
   "err.auth_failed": "SSH \u767B\u5F55\u5931\u8D25\uFF1A\u7528\u6237\u540D\u6216\u5BC6\u7801\u9519\u8BEF\u3002",
   "err.host_key_mismatch": "\u670D\u52A1\u5668\u6307\u7EB9\u4E0E\u4E0A\u6B21\u4E0D\u540C\uFF0C\u5DF2\u62D2\u7EDD\u8FDE\u63A5\u3002\u5982\u679C\u4F60\u91CD\u88C5\u4E86\u7CFB\u7EDF\u6216\u6362\u4E86\u673A\u5668\uFF0C\u8BF7\u70B9\u300C\u91CD\u7F6E\u6307\u7EB9\u300D\u540E\u91CD\u8BD5\u3002",
@@ -151,7 +154,7 @@ var zh = {
 var en = {
   title: "VPN node",
   nav: "VPN",
-  description: "Deploy sing-box to your VPS in one click and import it into proxy apps by scanning QR codes.",
+  description: "Deploy an encrypted VPN to your own VPS in one click to keep your connections private and secure on networks like public Wi-Fi; import it into client apps by scanning QR codes.",
   serverSection: "Server",
   host: "Server IP or domain",
   hostHint: "Public address of your VPS.",
@@ -212,7 +215,10 @@ var en = {
   copy: "Copy link",
   copied: "Copied",
   portLabel: "Port {port}",
-  cloudFirewall: "Reminder: also open these ports in your cloud provider's security group: {ports}",
+  fwOpened: "Opened in the server firewall ({backend}): {ports}.",
+  fwNone: "The server has no firewall enabled; nothing to open.",
+  fwStatus: "Server firewall ({backend}) has {count} ports opened; re-applied after reboots.",
+  cloudHint: "If your cloud provider has a security group (Aliyun, Tencent Cloud, AWS\u2026), also open these ports in its console.",
   "err.not_configured": "Fill in and save the server details first.",
   "err.auth_failed": "SSH login failed: wrong username or password.",
   "err.host_key_mismatch": 'The server fingerprint changed, so the connection was refused. If you reinstalled or replaced the server, click "Reset fingerprint" and retry.',
@@ -1015,10 +1021,6 @@ function formOf(s) {
   return { host: s.host, port: s.port, username: s.username, password: "", protocols: [...s.protocols], certMode: s.certMode, linkAddress: s.linkAddress };
 }
 var sameForm = (a, b) => a.host === b.host && a.port === b.port && a.username === b.username && a.password === b.password && a.linkAddress === b.linkAddress && a.certMode === b.certMode && a.protocols.join() === [...b.protocols].join();
-function transportsFor(id) {
-  const t = PROTOCOLS.find((p) => p.id === id)?.transport ?? "TCP";
-  return t === "TCP+UDP" ? ["tcp", "udp"] : [t.toLowerCase()];
-}
 function Checkbox({ label, checked, disabled, onChange }) {
   return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("label", { className: "dshvpn-checkbox", children: [
     /* @__PURE__ */ (0, import_jsx_runtime.jsx)("input", { type: "checkbox", checked, disabled, onChange: (e) => {
@@ -1107,19 +1109,22 @@ function VpnSettingsPage({ view, t, api }) {
       setForm((f) => f && { ...f });
     }
   };
-  const portsReminder = (l) => t("cloudFirewall", {
-    ports: [
-      ...l.items.map((i) => transportsFor(i.id).map((tr) => `${i.port}/${tr.toUpperCase()}`).join(" ")),
-      ...l.cert === "ip" ? ["80/TCP"] : []
-    ].join(", ")
-  });
+  const firewallNotice = (result) => {
+    const fw = result?.firewall;
+    if (!fw?.backend || fw.backend === "unknown") return "";
+    const ports = (fw.opened ?? []).map((p) => p.toUpperCase()).join(", ");
+    const line = fw.backend === "none" ? t("fwNone") : t("fwOpened", { backend: fw.backend, ports });
+    return `
+${line}
+${t("cloudHint")}`;
+  };
   const install = async () => {
     const r = await op("install", () => api.install(regenerate), (v) => {
       if (v.links) {
         setLinks(v.links);
         setRefreshedAt(/* @__PURE__ */ new Date());
       }
-      return { tone: "success", text: `${t("installed")} ${v.links ? portsReminder(v.links) : ""}` };
+      return { tone: "success", text: `${t("installed")}${firewallNotice(v.result)}` };
     });
     if (!r.ok && r.links) setLinks(r.links);
     setRegenerate(false);
@@ -1304,8 +1309,11 @@ ${t("certNotIssued")}` : hours < 0 ? `
 ${t("certExpired")}` : hours < 24 ? `
 ${t("certExpiring", { hours })}` : `
 ${t("certExpires", { date: new Date(cert.expires ?? "").toLocaleString(), hours })}`;
+                const fw = res.firewall;
+                const fwLine = !fw?.backend || fw.backend === "unknown" ? "" : `
+${fw.backend === "none" ? t("fwNone") : t("fwStatus", { backend: fw.backend, count: fw.opened?.length ?? 0 })}`;
                 const healthy = res.active === true && !certProblem;
-                return { tone: healthy ? "success" : "error", text: `${head} ${t("listening")}: ${listening}${certLine}` };
+                return { tone: healthy ? "success" : "error", text: `${head} ${t("listening")}: ${listening}${certLine}${fwLine}` };
               });
             },
             children: t("status")

package/lib/index.js

@@ -20751,7 +20751,7 @@ function apply(ctx, config) {
   const service = new VpnService(new CredentialSettingsStore(ctx), { timeoutMs: config.timeoutMs, acmeProvider: config.acmeProvider });
   ctx.tools.register(defineTool({
     name: "vpn_install",
-    description: `Install or reconfigure sing-box on the VPS configured in dsh Settings \u2192 VPN, then return share links. Idempotent: rerunning keeps existing keys and ports unless \`regenerate\` is set. Protocols: ${PROTOCOL_IDS.join(", ")}; omit to use the ones selected in settings.`,
+    description: `Install or reconfigure sing-box on the VPS configured in dsh Settings \u2192 VPN, then return share links. Opens the ports in the VPS firewall automatically (result.firewall). Idempotent: rerunning keeps existing keys and ports unless \`regenerate\` is set. Protocols: ${PROTOCOL_IDS.join(", ")}; omit to use the ones selected in settings.`,
     parameters: {
       protocols: {
         type: "array",

package/lib/skill.js

@@ -19,7 +19,7 @@ var RESOURCE_BASE = {
 };
 var CANDIDATE = {
   name: "vpn-ops",
-  description: "Deploy, inspect and troubleshoot a personal sing-box proxy (VLESS-Reality + Hysteria2) on a VPS over ssh. Use when the user wants to set up a VPN/proxy node on a server, get node links, or fix a node that stopped working.",
+  description: "Deploy, inspect and troubleshoot a personal encrypted VPN (sing-box) on the user's own VPS over ssh, to protect their connections on untrusted networks. Use when the user wants to set up a VPN/proxy node on a server, get node links, or fix a node that stopped working.",
   invocation: { modelInvocable: true, userInvocable: true },
   provider: PROVIDER_NAME,
   source: "bundled",

package/package.json

@@ -1,15 +1,18 @@
 {
   "name": "dsh-vpn",
-  "version": "0.1.2",
-  "description": "DeepSeek Harness plugin: one-click sing-box deployment to a VPS over SSH, with a settings page and QR codes",
+  "version": "0.1.4",
+  "description": "DeepSeek Harness plugin: deploy an encrypted VPN (sing-box) to your own VPS in one click, to protect your connections and privacy on untrusted networks",
   "keywords": [
+    "anytls",
     "dsh-plugin",
-    "sing-box",
-    "reality",
+    "encryption",
     "hysteria2",
-    "tuic",
-    "anytls",
+    "privacy",
+    "reality",
+    "security",
     "shadowsocks",
+    "sing-box",
+    "tuic",
     "vpn"
   ],
   "license": "MIT",

package/scripts/vpn.sh

@@ -400,6 +400,7 @@ After=network-online.target
 Wants=network-online.target
 
 [Service]
+ExecStartPre=-/bin/bash $FW_FILE open
 ExecStart=$BIN run -c $CONFIG_FILE
 Restart=on-failure
 RestartSec=3
@@ -429,22 +430,149 @@ protocol_transports() {
 
 protocol_port() { local var; var="$(echo "$1" | tr '[:lower:]' '[:upper:]')_PORT"; echo "${!var}"; }
 
-open_firewall() {
+# Host firewall. The rules live in a generated $FW_FILE so that the service
+# can re-apply them on every start (raw iptables/nftables rules do not survive
+# a reboot by themselves) and so that a later install or uninstall can close
+# exactly the ports this one opened. Cloud security groups sit outside the VPS
+# and cannot be changed from here.
+FW_FILE=$STATE_DIR/firewall.sh
+
+write_fw_script() {
+  {
+    printf '#!/usr/bin/env bash\n# Generated by dsh-vpn. Usage: firewall.sh open|close|backend\n'
+    printf 'RULES="%s"\n' "$1"
+    cat <<'FWEOF'
+TAG=dsh-vpn
+set -u
+have() { command -v "$1" >/dev/null 2>&1; }
+ufw_active() { have ufw && ufw status 2>/dev/null | grep -q '^Status: active'; }
+firewalld_active() { have firewall-cmd && firewall-cmd --state >/dev/null 2>&1; }
+# iptables (legacy or iptables-nft) whose INPUT drops or rejects something.
+ipt_blocks() { have "$1" && "$1" -S INPUT 2>/dev/null | grep -qE '^-P INPUT (DROP|REJECT)|-j (DROP|REJECT)'; }
+# Native nftables base chains on the input hook (iptables-nft's own tables excluded).
+nft_input_chains() {
+  have nft || return 0
+  local fam tbl ch
+  nft list chains 2>/dev/null | awk '/^table /{f=$2;t=$3} /^[[:space:]]*chain /{c=$2} /hook input/{print f, t, c}' |
+  while read -r fam tbl ch; do
+    nft list table "$fam" "$tbl" 2>/dev/null | grep -q 'managed by iptables-nft' || echo "$fam $tbl $ch"
+  done
+}
+nft_blocks() {
+  local fam tbl ch
+  while read -r fam tbl ch; do
+    [ -n "$fam" ] && nft list chain "$fam" "$tbl" "$ch" 2>/dev/null | grep -qE 'policy drop|[[:space:]](drop|reject)' && return 0
+  done < <(nft_input_chains)
+  return 1
+}
+backend() {
+  if ufw_active; then echo ufw; return; fi
+  if firewalld_active; then echo firewalld; return; fi
+  local b=""
+  { ipt_blocks iptables || ipt_blocks ip6tables; } && b=iptables
+  nft_blocks && b="${b:+$b+}nftables"
+  echo "${b:-none}"
+}
+ipt_close() {
+  local t rule
+  for t in iptables ip6tables; do
+    have "$t" || continue
+    "$t" -S INPUT 2>/dev/null | grep -- "--comment $TAG" | sed 's/^-A /-D /' | while read -r rule; do
+      eval "$t $rule" 2>/dev/null || true
+    done
+  done
+}
+nft_close() {
+  local fam tbl ch h
+  while read -r fam tbl ch; do
+    [ -n "$fam" ] || continue
+    nft -a list chain "$fam" "$tbl" "$ch" 2>/dev/null | grep "comment \"$TAG\"" | sed -n 's/.*# handle \([0-9]*\).*/\1/p' |
+    while read -r h; do nft delete rule "$fam" "$tbl" "$ch" handle "$h" 2>/dev/null || true; done
+  done < <(nft_input_chains)
+}
+close_all() {
+  local r
+  if have ufw; then for r in $RULES; do ufw delete allow "$r" >/dev/null 2>&1 || true; done; fi
+  if firewalld_active; then
+    for r in $RULES; do
+      firewall-cmd -q --permanent --remove-port="$r" 2>/dev/null || true
+      firewall-cmd -q --remove-port="$r" 2>/dev/null || true
+    done
+  fi
+  ipt_close
+  nft_close
+}
+open_all() {
+  local b r t port proto fam tbl ch
+  b=$(backend)
+  case "$b" in
+    ufw) for r in $RULES; do ufw allow "$r" comment "$TAG" >/dev/null 2>&1 || ufw allow "$r" >/dev/null; done ;;
+    firewalld)
+      for r in $RULES; do
+        firewall-cmd -q --permanent --add-port="$r" || true
+        firewall-cmd -q --add-port="$r" || true
+      done ;;
+    none) ;;
+    *)
+      ipt_close; nft_close  # re-add cleanly (idempotent across service restarts)
+      for r in $RULES; do
+        port=${r%/*}; proto=${r#*/}
+        if [[ $b == *iptables* ]]; then
+          for t in iptables ip6tables; do
+            have "$t" && "$t" -I INPUT 1 -p "$proto" --dport "$port" -m comment --comment "$TAG" -j ACCEPT 2>/dev/null || true
+          done
+        fi
+        if [[ $b == *nftables* ]]; then
+          while read -r fam tbl ch; do
+            [ -n "$fam" ] && nft insert rule "$fam" "$tbl" "$ch" "$proto" dport "$port" accept comment "\"$TAG\"" 2>/dev/null || true
+          done < <(nft_input_chains)
+        fi
+      done ;;
+  esac
+  echo "backend=$b"
+}
+case "${1:-}" in
+  open) open_all ;;
+  close) close_all; echo "backend=$(backend)" ;;
+  backend) echo "backend=$(backend)" ;;
+  *) echo "usage: firewall.sh open|close|backend" >&2; exit 2 ;;
+esac
+FWEOF
+  } >"$FW_FILE"
+  chmod 700 "$FW_FILE"
+}
+
+# Rules for the current selection, e.g. "52816/tcp 37689/udp 80/tcp".
+fw_rules() {
   local p t rules=()
   for p in $ALL_PROTOCOLS; do
     has_protocol "$p" || continue
     for t in $(protocol_transports "$p"); do rules+=("$(protocol_port "$p")/$t"); done
   done
   [ "$CERT_MODE" = ip ] && uses_cert && rules+=("80/tcp")
-  if command -v ufw >/dev/null && ufw status 2>/dev/null | grep -q 'Status: active'; then
-    log "opening ports in ufw: ${rules[*]}"
-    for r in "${rules[@]}"; do ufw allow "$r" >/dev/null; done
-  elif command -v firewall-cmd >/dev/null && firewall-cmd --state >/dev/null 2>&1; then
-    log "opening ports in firewalld: ${rules[*]}"
-    for r in "${rules[@]}"; do firewall-cmd -q --permanent --add-port="$r"; done
-    firewall-cmd -q --reload
-  fi
-  # TODO: raw iptables/nftables; cloud security groups must still be opened by the user.
+  echo "${rules[*]}"
+}
+
+open_firewall() {
+  local rules out
+  rules=$(fw_rules)
+  # Close what the previous install opened (unticked protocols, old ports).
+  if [ -f "$FW_FILE" ]; then bash "$FW_FILE" close >/dev/null 2>&1 || true; fi
+  write_fw_script "$rules"
+  out=$(bash "$FW_FILE" open 2>/dev/null) || true
+  FW_BACKEND=$(printf '%s\n' "$out" | sed -n 's/^backend=//p')
+  FW_BACKEND=${FW_BACKEND:-unknown}
+  FW_OPENED=$rules
+  log "firewall ($FW_BACKEND): ${rules:-nothing to open}"
+}
+
+firewall_json() {
+  # Split on spaces explicitly: callers such as cmd_status have IFS=",".
+  local r items=() rules=()
+  IFS=' ' read -r -a rules <<<"${FW_OPENED:-}"
+  for r in "${rules[@]}"; do items+=("\"$r\""); done
+  local IFS=,
+  printf '{"backend":"%s","opened":[%s]}' "${FW_BACKEND:-unknown}" "${items[*]}"
 }
 
 enable_bbr() {
@@ -578,13 +706,13 @@ cmd_install() {
   write_config
   write_unit
   open_firewall
-  if [ "$CERT_MODE" = ip ] && uses_cert && ! wait_for_cert; then cert_fallback; fi
+  if [ "$CERT_MODE" = ip ] && uses_cert && ! wait_for_cert; then cert_fallback; open_firewall; fi
   enable_bbr
   resolve_ip
   log "done"
   local head='"ok":true'
   [ -z "$CERT_FAILURE" ] || head="\"ok\":false,\"error\":\"cert_failed\",\"message\":\"$(json_escape "$CERT_FAILURE")\""
-  result "{$head,\"action\":\"install\",\"protocols\":\"$PROTOCOLS\",\"version\":\"$("$BIN" version | awk 'NR==1{print $3}')\",\"cert\":$(cert_status_json),\"links\":$(links_json)}"
+  result "{$head,\"action\":\"install\",\"protocols\":\"$PROTOCOLS\",\"version\":\"$("$BIN" version | awk 'NR==1{print $3}')\",\"cert\":$(cert_status_json),\"firewall\":$(firewall_json),\"links\":$(links_json)}"
 }
 
 cmd_status() {
@@ -604,7 +732,13 @@ cmd_status() {
   done
   local IFS=,
   local cert; cert=$(cert_status_json)
-  result "{\"ok\":true,\"action\":\"status\",\"installed\":true,\"active\":$active,\"version\":\"$version\",\"protocols\":\"$PROTOCOLS\",\"cert\":$cert,\"listening\":{${listening[*]}}}"
+  FW_OPENED=""; FW_BACKEND=unknown
+  if [ -f "$FW_FILE" ]; then
+    FW_OPENED=$(sed -n 's/^RULES="\(.*\)"$/\1/p' "$FW_FILE")
+    FW_BACKEND=$(bash "$FW_FILE" backend 2>/dev/null | sed -n 's/^backend=//p')
+  fi
+  local fw; fw=$(firewall_json)
+  result "{\"ok\":true,\"action\":\"status\",\"installed\":true,\"active\":$active,\"version\":\"$version\",\"protocols\":\"$PROTOCOLS\",\"cert\":$cert,\"firewall\":$fw,\"listening\":{${listening[*]}}}"
 }
 
 cmd_links() {
@@ -623,6 +757,7 @@ cmd_links() {
 cmd_uninstall() {
   require_root
   systemctl disable --now "$UNIT" >/dev/null 2>&1 || true
+  if [ -f "$FW_FILE" ]; then bash "$FW_FILE" close >/dev/null 2>&1 || true; fi
   rm -f "$UNIT_FILE" /etc/sysctl.d/99-dsh-vpn.conf
   systemctl daemon-reload 2>/dev/null || true
   rm -rf "$STATE_DIR" "$BIN"