Something went wrong. Try again.
Something went wrong. Try again.
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116#!/bin/bashset -euo pipefail # Exit on error, undefined vars, and pipeline failuresIFS=$'\n\t' # Stricter word splitting
# Read allowed domains from fileALLOWED_DOMAINS_FILE="/etc/codex/allowed_domains.txt"if [ -f "$ALLOWED_DOMAINS_FILE" ]; then ALLOWED_DOMAINS=() while IFS= read -r domain; do ALLOWED_DOMAINS+=("$domain") done < "$ALLOWED_DOMAINS_FILE" echo "Using domains from file: ${ALLOWED_DOMAINS[*]}"else # Fallback to default domains ALLOWED_DOMAINS=("api.openai.com") echo "Domains file not found, using default: ${ALLOWED_DOMAINS[*]}"fi
# Ensure we have at least one domainif [ ${#ALLOWED_DOMAINS[@]} -eq 0 ]; then echo "ERROR: No allowed domains specified" exit 1fi
# Flush existing rules and delete existing ipsetsiptables -Fiptables -Xiptables -t nat -Fiptables -t nat -Xiptables -t mangle -Fiptables -t mangle -Xipset destroy allowed-domains 2>/dev/null || true
# First allow DNS and localhost before any restrictions# Allow outbound DNSiptables -A OUTPUT -p udp --dport 53 -j ACCEPT# Allow inbound DNS responsesiptables -A INPUT -p udp --sport 53 -j ACCEPT# Allow localhostiptables -A INPUT -i lo -j ACCEPTiptables -A OUTPUT -o lo -j ACCEPT
# Create ipset with CIDR supportipset create allowed-domains hash:net
# Resolve and add other allowed domainsfor domain in "${ALLOWED_DOMAINS[@]}"; do echo "Resolving $domain..." ips=$(dig +short A "$domain") if [ -z "$ips" ]; then echo "ERROR: Failed to resolve $domain" exit 1 fi
while read -r ip; do if [[ ! "$ip" =~ ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$ ]]; then echo "ERROR: Invalid IP from DNS for $domain: $ip" exit 1 fi echo "Adding $ip for $domain" ipset add allowed-domains "$ip" done < <(echo "$ips")done
# Get host IP from default routeHOST_IP=$(ip route | grep default | cut -d" " -f3)if [ -z "$HOST_IP" ]; then echo "ERROR: Failed to detect host IP" exit 1fi
HOST_NETWORK=$(echo "$HOST_IP" | sed "s/\.[0-9]*$/.0\/24/")echo "Host network detected as: $HOST_NETWORK"
# Set up remaining iptables rulesiptables -A INPUT -s "$HOST_NETWORK" -j ACCEPTiptables -A OUTPUT -d "$HOST_NETWORK" -j ACCEPT
# Set default policies to DROP firstiptables -P INPUT DROPiptables -P FORWARD DROPiptables -P OUTPUT DROP
# First allow established connections for already approved trafficiptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPTiptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# Then allow only specific outbound traffic to allowed domainsiptables -A OUTPUT -m set --match-set allowed-domains dst -j ACCEPT
# Append final REJECT rules for immediate error responses# For TCP traffic, send a TCP reset; for UDP, send ICMP port unreachable.iptables -A INPUT -p tcp -j REJECT --reject-with tcp-resetiptables -A INPUT -p udp -j REJECT --reject-with icmp-port-unreachableiptables -A OUTPUT -p tcp -j REJECT --reject-with tcp-resetiptables -A OUTPUT -p udp -j REJECT --reject-with icmp-port-unreachableiptables -A FORWARD -p tcp -j REJECT --reject-with tcp-resetiptables -A FORWARD -p udp -j REJECT --reject-with icmp-port-unreachable
echo "Firewall configuration complete"echo "Verifying firewall rules..."if curl --connect-timeout 5 https://example.com >/dev/null 2>&1; then echo "ERROR: Firewall verification failed - was able to reach https://example.com" exit 1else echo "Firewall verification passed - unable to reach https://example.com as expected"fi
# Always verify OpenAI API access is workingif ! curl --connect-timeout 5 https://api.openai.com >/dev/null 2>&1; then echo "ERROR: Firewall verification failed - unable to reach https://api.openai.com" exit 1else echo "Firewall verification passed - able to reach https://api.openai.com as expected"fi