Timmy
2ffa06ac80
Docker Compose 部署 Tailscale 連線至自架 Headscale 控制伺服器， 包含子網路由、出口節點、iptables NAT 設定及完整中文文件。 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
45 lines
1.5 KiB
Bash
Executable File
45 lines
1.5 KiB
Bash
Executable File
#!/bin/bash
|
||
|
||
echo "🧹 清除所有規則並重設策略..."
|
||
iptables -F
|
||
iptables -t nat -F
|
||
iptables -X
|
||
|
||
# 設定預設策略
|
||
# iptables -P INPUT DROP
|
||
iptables -P INPUT ACCEPT
|
||
iptables -P FORWARD ACCEPT
|
||
# iptables -P FORWARD DROP
|
||
iptables -P OUTPUT ACCEPT
|
||
|
||
echo "✅ 設定 INPUT 安全規則..."
|
||
|
||
# 允許已建立與相關的連線（像是回應封包）
|
||
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT -m comment --comment "Allow established/related"
|
||
|
||
# 允許 loopback
|
||
iptables -A INPUT -i lo -j ACCEPT -m comment --comment "Allow loopback"
|
||
|
||
# 允許 ICMP (ping)
|
||
iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT -m comment --comment "Allow ping"
|
||
|
||
# 允許 SSH
|
||
iptables -A INPUT -p tcp --dport 22 -j ACCEPT -m comment --comment "Allow SSH"
|
||
|
||
# 可選：允許 HTTP/HTTPS（如果有 Web 應用）
|
||
iptables -A INPUT -p tcp --dport 80 -j ACCEPT -m comment --comment "Allow HTTP"
|
||
iptables -A INPUT -p tcp --dport 443 -j ACCEPT -m comment --comment "Allow HTTPS"
|
||
|
||
echo "🔧 設定 Tailscale 出口 NAT（MASQUERADE）"
|
||
iptables -t nat -A POSTROUTING -s 100.64.0.0/10 -o eth0 -j MASQUERADE -m comment --comment "Tailscale NAT"
|
||
|
||
echo "🔧 允許 Tailscale → LAN 轉送"
|
||
iptables -A FORWARD -i tailscale0 -o eth0 -j ACCEPT -m comment --comment "Tailscale → LAN"
|
||
iptables -A FORWARD -i eth0 -o tailscale0 -m state --state RELATED,ESTABLISHED -j ACCEPT -m comment --comment "LAN → Tailscale return"
|
||
|
||
echo "📦 儲存規則（iptables-persistent）"
|
||
iptables-save > /etc/iptables/rules.v4
|
||
|
||
echo "✅ 防火牆與 NAT 重設完成！"
|
||
|