configure_priv.sh

@@ -353,49 +353,49 @@ configure_fail2ban() {
     fi
 }
 
-# configure_iptables() {
-#     [ $offline -eq 1 ] && return
-#     [ "$(uname)" = "Darwin" ] && return
+configure_iptables() {
+    [ $offline -eq 1 ] && return
+    [ "$(uname)" = "Darwin" ] && return
 
-#     # 如果 ufw 是 active，就直接返回
-#     if command_exists ufw; then
-#         if sudo ufw status | grep -q "Status: active"; then
-#             echo "检测到 ufw 已启用，跳过 iptables 配置。"
-#             return
-#         fi
-#         if confirm_action "检测到 ufw 已存在，是否直接使用 ufw 进行管理，跳过 iptables" "Y"; then
-#             return
-#         fi
-#     fi
+    # 如果 ufw 是 active，就直接返回
+    if command_exists ufw; then
+        if sudo ufw status | grep -q "Status: active"; then
+            echo "检测到 ufw 已启用，跳过 iptables 配置。"
+            return
+        fi
+        if confirm_action "检测到 ufw 已存在，是否直接使用 ufw 进行管理，跳过 iptables" "Y"; then
+            return
+        fi
+    fi
 
-#     if command_exists ifquery && systemctl is-active --quiet networking; then
-#         # ifupdown: /etc/network/if-pre-up.d/iptables-load
-#         [ -f /etc/network/if-pre-up.d/iptables-load ] && return
-#         if confirm_action "要配置 iptables 吗？" "N"; then
-#             sudo cp $scriptdir/files/iptables-load /etc/network/if-pre-up.d/iptables-load
-#             sudo chmod +x /etc/network/if-pre-up.d/iptables-load
-#             sudo sh /etc/network/if-pre-up.d/iptables-load
-#         fi
-#     else
-#         # systemd: /etc/network/iptables-load
-#         [ -f /etc/network/iptables-load ] && return
-#         if confirm_action "要配置 iptables 吗？" "N"; then
-#             if [ -f /etc/network/if-pre-up.d/iptables-load ]; then
-#                 sudo mv /etc/network/if-pre-up.d/iptables-load /etc/network/iptables-load
-#             else
-#                 sudo cp $scriptdir/files/iptables-load /etc/network/iptables-load
-#                 sudo chmod +x /etc/network/iptables-load
-#                 sudo sh /etc/network/iptables-load
-#             fi
+    if command_exists ifquery && systemctl is-active --quiet networking; then
+        # ifupdown: /etc/network/if-pre-up.d/iptables-load
+        [ -f /etc/network/if-pre-up.d/iptables-load ] && return
+        if confirm_action "要配置 iptables 吗？" "N"; then
+            sudo cp $scriptdir/files/iptables-load /etc/network/if-pre-up.d/iptables-load
+            sudo chmod +x /etc/network/if-pre-up.d/iptables-load
+            sudo sh /etc/network/if-pre-up.d/iptables-load
+        fi
+    else
+        # systemd: /etc/network/iptables-load
+        [ -f /etc/network/iptables-load ] && return
+        if confirm_action "要配置 iptables 吗？" "N"; then
+            if [ -f /etc/network/if-pre-up.d/iptables-load ]; then
+                sudo mv /etc/network/if-pre-up.d/iptables-load /etc/network/iptables-load
+            else
+                sudo cp $scriptdir/files/iptables-load /etc/network/iptables-load
+                sudo chmod +x /etc/network/iptables-load
+                sudo sh /etc/network/iptables-load
+            fi
 
-#             sudo cp $scriptdir/files/iptables-load.service /etc/systemd/system/iptables-load.service
-#             sudo chmod +x /etc/systemd/system/iptables-load.service
-#             sudo systemctl daemon-reload
-#             sudo systemctl start iptables-load.service
-#             sudo systemctl enable iptables-load.service
-#         fi
-#     fi
-# }
+            sudo cp $scriptdir/files/iptables-load.service /etc/systemd/system/iptables-load.service
+            sudo chmod +x /etc/systemd/system/iptables-load.service
+            sudo systemctl daemon-reload
+            sudo systemctl start iptables-load.service
+            sudo systemctl enable iptables-load.service
+        fi
+    fi
+}
 
 configure_ufw() {
     [ $offline -eq 1 ] && return

files/jail.local

@@ -11,9 +11,6 @@ maxretry = 5
 # banaction = firewallcmd-ipset
 # action    = %(action_mwl)s
 
-banaction = nftables
-banaction_allports = nftables[type=allports]
-
 [sshd]
 enabled = true
 filter  = sshd

files/zsh/51-alias.zsh

@@ -13,7 +13,7 @@ alias hg='history | grep'
 command_exists() { command -v "$@" >/dev/null 2>&1; }
 
 if command_exists iptables; then
-    alias ipl='sudo iptables -L -n -v'
+    alias ipl='sudo iptables -L -n'
     if [ -f "/etc/network/iptables-load" ]; then
         alias ipe='sudo vi /etc/network/iptables-load'
         alias ips='sudo /etc/network/iptables-load'