Repository navigation
Expand file tree
/
Copy pathapply-firewall.sh
More file actions
executable file
·51 lines (51 loc) · 1.84 KB
/
Copy pathapply-firewall.sh
File metadata and controls
executable file
·51 lines (51 loc) · 1.84 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
#!/usr/bin/env bash
# Apply MAC-gated NAT + default-deny rules from device store.
set -euo pipefail
cd /opt/array-firewall/api
export PYTHONPATH=/opt/array-firewall/api
python3 - <<'PY'
from lib import devices, nft, perf, qos, stability
devices.discover()
nft.apply_ruleset()
print("[apply-firewall] rules applied, allowed:", devices.allowed_macs())
try:
stability.bootstrap_on_boot()
print("[apply-firewall] stability bootstrap done")
except Exception as exc:
print("[apply-firewall] stability bootstrap skipped:", exc)
try:
perf.apply_tune()
print("[apply-firewall] perf tune applied")
except Exception as exc:
print("[apply-firewall] perf tune skipped:", exc)
try:
qos.apply()
print("[apply-firewall] qos applied")
except Exception as exc:
print("[apply-firewall] qos skipped:", exc)
try:
from lib import gaming, policies, qos
if policies.xbox_wan_dmz_enabled():
if policies.role() == "xbox_router":
speed = qos.ensure_xbox_speed()
print("[apply-firewall] xbox speed:", speed.get("contract_mbit"), "mbit profile=", (speed.get("qos") or {}).get("profile"))
r = gaming.ensure_sentinel_wrapper()
print("[apply-firewall] sentinel wrapper:", r.get("wrapper_ok"), "level=", r.get("shield_level"))
else:
from pathlib import Path
from lib import peer_blocklist
state = Path("/var/lib/array-firewall/packet-shield.state")
if state.is_file() and "mode=shield" in state.read_text():
peer_blocklist.sync_shield()
print("[apply-firewall] packet shield resynced")
except Exception as exc:
print("[apply-firewall] sentinel wrapper skipped:", exc)
from lib import nat
nat.ensure_wan_nat()
nat.sync_upnp_runtime()
try:
from lib import ipv6
ipv6.apply()
except Exception as exc:
print("[apply-firewall] ipv6 skipped:", exc)
PY