MythEclipse/asepharyana-hub
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

firewall: whitelist TCPShield proxy ranges untuk port 25565 (Minecraft)

Browse Source
This commit is contained in:
asepharyana
2026-08-06 20:42:39 +07:00
committed by Asep Haryana
parent 99e438d9c5
commit 97b635e8c6
1 changed files with 26 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
infra/firewall/firewall.sh
+26 -7
View File
@@ -2,10 +2,30 @@
# ============================================================
# firewall.sh — deny-by-default firewall untuk orangevps
# Public: 22 (SSH), 80/443 (Caddy), 4013 (hermes dashboard)
# 25565 (Minecraft) — WHITELIST TCPShield proxy only
# Tailscale CGNAT 100.64/10: semua port (imrnes & node lain)
# Localhost: semua
# Sisanya: DROP + log
# ============================================================
# TCPShield proxy ranges (https://tcpshield.com/v4/ + /v4-cf/)
# Update saat TCPShield publish range baru.
TCPSHIELD_V4=(
198.178.119.0/24
104.234.6.0/24
)
TCPSHIELD_V4_CF=(
89.222.122.36/31
152.233.22.8/31
89.222.108.246/31
84.17.55.186/31
51.79.45.52/31
5.135.84.92/30
51.75.35.44/30
51.161.27.110/31
152.233.30.16/31
152.233.30.232/31
203.205.31.160/31
)
set -e
### IPv4 ###
@@ -33,6 +53,10 @@ iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j ACCEPT
# Public: hermes dashboard (auth-protected)
iptables -A INPUT -p tcp --dport 4013 -j ACCEPT
# Public: Minecraft (FTB sky) — hanya dari proxy TCPShield
for cidr in "${TCPSHIELD_V4[@]}" "${TCPSHIELD_V4_CF[@]}"; do
iptables -A INPUT -s "$cidr" -p tcp --dport 25565 -j ACCEPT
done
# ICMP (ping, PMTU)
iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 5/sec --limit-burst 10 -j ACCEPT
@@ -66,15 +90,10 @@ ip6tables -A INPUT -p tcp --dport 22 -j ACCEPT
ip6tables -A INPUT -p tcp --dport 80 -j ACCEPT
ip6tables -A INPUT -p tcp --dport 443 -j ACCEPT
ip6tables -A INPUT -p tcp --dport 4013 -j ACCEPT
# ICMPv6/MLD: ping + neighbor discovery (NIC multicast ff02::1 = MLDv2 reports
# dari host lain; kena LOG+DROP tiap menit — 1800 baris/6h di journal).
# IPv6 layer-2 discovery WAJIB di-ACCEPT, bukan cuma dropped.
# Minecraft 25565: TCPShield IPv4 only — tidak ada range IPv6 publik
ip6tables -A INPUT -p icmpv6 -j ACCEPT
ip6tables -A INPUT -d ff02::1 -j ACCEPT
ip6tables -A INPUT -d ff02::2 -j ACCEPT
ip6tables -A INPUT -d ff02::fb -j ACCEPT
ip6tables -A INPUT -m limit --limit 5/min --limit-burst 10 -j LOG --log-prefix "FW6-DROP " --log-level 4
ip6tables -A INPUT -j DROP
echo "Firewall applied:"
iptables -L INPUT -n --line-numbers | head -20
iptables -L INPUT -n --line-numbers | head -24