98 lines
3.2 KiB
Bash
Executable File
98 lines
3.2 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
# Fix UDM Pro Firewall Rules for Container Outbound Access
|
|
# Adds allow rules for container IPs to access internet
|
|
|
|
set -euo pipefail
|
|
|
|
UDM_PRO_IP="192.168.11.1"
|
|
UDM_PRO_USER="OQmQuS"
|
|
UDM_PRO_PASS="m0MFXHdgMFKGB2l3bO4"
|
|
CONTAINER_IPS=("192.168.11.166" "192.168.11.167")
|
|
|
|
# Colors
|
|
RED='\033[0;31m'
|
|
GREEN='\033[0;32m'
|
|
YELLOW='\033[1;33m'
|
|
BLUE='\033[0;34m'
|
|
NC='\033[0m'
|
|
|
|
echo "=========================================="
|
|
echo "Fix UDM Pro Firewall for Container Access"
|
|
echo "=========================================="
|
|
echo ""
|
|
|
|
# Note: UDM Pro firewall rules are typically managed via Web UI
|
|
# This script provides diagnostic information and recommendations
|
|
|
|
echo -e "${BLUE}Checking current firewall rules...${NC}"
|
|
|
|
# Check FORWARD chain
|
|
FORWARD_RULES=$(sshpass -p "$UDM_PRO_PASS" ssh -o ConnectTimeout=10 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o LogLevel=ERROR ${UDM_PRO_USER}@${UDM_PRO_IP} \
|
|
"sudo iptables -L FORWARD -n -v --line-numbers 2>&1 | head -40" 2>&1)
|
|
|
|
echo "FORWARD chain rules:"
|
|
echo "$FORWARD_RULES" | head -20
|
|
|
|
# Check for deny rules
|
|
DENY_RULES=$(echo "$FORWARD_RULES" | grep -E "DROP|REJECT" | head -5)
|
|
if [ -n "$DENY_RULES" ]; then
|
|
echo ""
|
|
echo -e "${YELLOW}⚠️ Found deny rules that may block traffic:${NC}"
|
|
echo "$DENY_RULES"
|
|
fi
|
|
|
|
# Check OUTPUT chain
|
|
OUTPUT_RULES=$(sshpass -p "$UDM_PRO_PASS" ssh -o ConnectTimeout=10 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o LogLevel=ERROR ${UDM_PRO_USER}@${UDM_PRO_IP} \
|
|
"sudo iptables -L OUTPUT -n -v --line-numbers 2>&1 | head -30" 2>&1)
|
|
|
|
echo ""
|
|
echo "OUTPUT chain rules:"
|
|
echo "$OUTPUT_RULES" | head -20
|
|
|
|
# Check policy
|
|
FORWARD_POLICY=$(sshpass -p "$UDM_PRO_PASS" ssh -o ConnectTimeout=10 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o LogLevel=ERROR ${UDM_PRO_USER}@${UDM_PRO_IP} \
|
|
"sudo iptables -L FORWARD -n 2>&1 | grep 'Chain FORWARD' | grep -o 'policy [A-Z]*'" 2>&1)
|
|
|
|
echo ""
|
|
echo "FORWARD chain policy: $FORWARD_POLICY"
|
|
|
|
if echo "$FORWARD_POLICY" | grep -q "DROP"; then
|
|
echo -e "${RED}❌ FORWARD chain policy is DROP${NC}"
|
|
echo "This will block all forwarded traffic unless explicitly allowed"
|
|
echo ""
|
|
echo "Solution: Add allow rules in UDM Pro Web UI:"
|
|
echo " 1. Settings → Firewall & Security → Firewall Rules"
|
|
echo " 2. Add rule: Allow outbound from 192.168.11.166/167"
|
|
echo " 3. Place rule BEFORE any deny rules"
|
|
else
|
|
echo -e "${GREEN}✅ FORWARD chain policy allows traffic${NC}"
|
|
fi
|
|
|
|
echo ""
|
|
echo "=========================================="
|
|
echo "UDM Pro Firewall Fix Instructions"
|
|
echo "=========================================="
|
|
echo ""
|
|
echo "To fix outbound internet access for containers:"
|
|
echo ""
|
|
echo "1. Access UDM Pro Web UI: https://192.168.11.1"
|
|
echo ""
|
|
echo "2. Go to: Settings → Firewall & Security → Firewall Rules"
|
|
echo ""
|
|
echo "3. Add new rule:"
|
|
echo " - Name: Allow Container Outbound"
|
|
echo " - Action: Accept"
|
|
echo " - Source: 192.168.11.166, 192.168.11.167"
|
|
echo " - Destination: Any"
|
|
echo " - Protocol: Any"
|
|
echo " - Port: Any"
|
|
echo ""
|
|
echo "4. Ensure rule is placed BEFORE any deny rules"
|
|
echo ""
|
|
echo "5. Save and wait 30 seconds"
|
|
echo ""
|
|
echo "Note: UDM Pro may require rules to be added via Web UI"
|
|
echo " Direct iptables changes may not persist"
|
|
echo ""
|