ramm 0.0.10 → 0.0.11

package/dist/ramm.js

@@ -155,28 +155,6 @@ var createSystemdService = async (context, serviceName, pathToServiceFile) => {
   await execCommand(formatUserspace(context, `sysyemctl start ${serviceName}`));
 };
 
-// src/nft.ts
-var localNftChainName = "local_chain";
-var setupNftable = async (allowedIpSsh) => {
-  const listTable = await execCommandSilent("nft list table inet ramm");
-  if (listTable.spawnResult.exitCode === 0) {
-    await execCommand("nft delete table inet ramm");
-  }
-  await execCommand("nft add table inet ramm");
-  await execCommand("nft add chain inet ramm input '{ type filter hook input priority 0 ; }'");
-  await execCommand(`nft add set inet ramm allowed_ssh_ipv4 '{ type ipv4_addr; flags dynamic; elements = { ${allowedIpSsh} } }'`);
-  await execCommand(`nft add chain inet ramm ${localNftChainName}`);
-  await execCommand(`nft add rule inet ramm ${localNftChainName} iif lo accept`);
-  await execCommand(`nft add rule inet ramm ${localNftChainName} ct state established,related accept`);
-  await execCommand(`nft add rule inet ramm ${localNftChainName} ip saddr @allowed_ssh_ipv4 tcp dport 22 accept`);
-  await execCommand(`nft add rule inet ramm ${localNftChainName} tcp dport 22 ct state new limit rate over 3/minute drop`);
-  await execCommand(`nft add rule inet ramm ${localNftChainName} tcp dport 22 accept`);
-  await execCommand(`nft add rule inet ramm ${localNftChainName} tcp dport 80 accept`);
-  await execCommand(`nft add rule inet ramm ${localNftChainName} tcp dport 443 accept`);
-  await execCommand(`nft add rule inet ramm ${localNftChainName} drop`);
-  await execCommand("nft add rule inet ramm input fib daddr type local jump local_chain ");
-};
-
 // src/podman.ts
 var installPodman = async () => {
   if ((await $2`command -v podman`.nothrow().quiet()).exitCode !== 0) {
@@ -185,6 +163,10 @@ var installPodman = async () => {
   await createNetwork();
 };
 var createNetwork = async () => {
+  const netwroks = await execCommand("podman network inspect $(podman network ls -q) -f '{{.NetworkInterface}}'");
+  if (netwroks.output.includes("podman_ramm")) {
+    return;
+  }
   await execCommand("podman network create --interface-name=podman_ramm ramm");
 };
 var getCreateCommand = async (name) => {
@@ -213,8 +195,47 @@ var addNftPodmanRule = async () => {
   const podmanNetworks = podmanNetworksResult.output.trim().split(`
 `);
   await execCommand(`nft add set inet ramm podman_interfaces '{ type ifname; flags dynamic; elements = { ${podmanNetworks.join(", ")} }; }'`);
-  await execCommand("nft add chain inet ramm forward '{ type filter hook forward priority 0 ; }'");
-  await execCommand(`nft add rule inet ramm forward iifname != @podman_interfaces jump ${localNftChainName}`);
+  await execCommand("nft insert rule inet ramm prerouting iifname @podman_interfaces accept");
+};
+// src/nft.ts
+var createNftTable = (allowed_ssh_ipv4) => {
+  const nftTable = `table inet ramm {
+    set allowed_ssh_ipv4 {
+      type ipv4_addr
+      flags dynamic
+      elements = { ${allowed_ssh_ipv4} }
+    }
+
+    chain local_chain {
+      iif "lo" accept 
+      ct state established,related accept
+      ip saddr @allowed_ssh_ipv4 tcp dport 22 accept
+      tcp dport 22 ct state new limit rate over 3/minute burst 5 packets drop
+      tcp dport 22 accept
+      tcp dport 80 accept
+      tcp dport 443 accept
+      drop
+    }
+
+    chain prerouting {
+      type filter hook prerouting priority mangle; policy accept;
+      fib daddr type local jump local_chain
+    }
+  }
+  `;
+  return nftTable;
+};
+var setupNftable = async (allowedIpSsh) => {
+  const listTable = await execCommandSilent("nft list table inet ramm");
+  if (listTable.spawnResult.exitCode === 0) {
+    await execCommand("nft delete table inet ramm");
+  }
+  const nftTable = createNftTable(allowedIpSsh);
+  await execCommand(`nft -f - <<EOF
+${nftTable}
+EOF`);
+  await execCommand("nft list ruleset > /etc/nftables.conf");
+  await execCommand("systemctl enable nftables");
 };
 // src/files.ts
 import { appendFile, exists } from "fs/promises";

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "ramm",
   "type": "module",
-  "version": "0.0.10",
+  "version": "0.0.11",
   "scripts": {
     "build": "bun build ./src/ramm.ts --target bun --outdir ./dist && cp ./src/bun.sh ./dist/bun.sh && bun run types",
     "types": "tsc --project tsconfig.types.json"