From 59f9bb9ba87e8299052fbadbb959f0ac5132f39c Mon Sep 17 00:00:00 2001 From: AlexChard Date: Sun, 30 Aug 2026 13:50:16 +0400 Subject: [PATCH] =?UTF-8?q?=D0=9E=D0=B1=D0=BD=D0=BE=D0=B2=D0=B8=D1=82?= =?UTF-8?q?=D1=8C=20install.sh?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add safe uninstall and hide destination IP after setup --- install.sh | 98 ++++++++++++++++++++++++++++++++++++++++++++++-------- 1 file changed, 85 insertions(+), 13 deletions(-) diff --git a/install.sh b/install.sh index d13626e..a69cdfe 100644 --- a/install.sh +++ b/install.sh @@ -8,6 +8,7 @@ YELLOW='\033[1;33m' MAGENTA='\033[0;35m' WHITE='\033[1;37m' NC='\033[0m' +KASKAD_COMMENT="BERLOGA-KASKAD" check_root() { if [ "$EUID" -ne 0 ]; then @@ -170,22 +171,26 @@ apply_iptables_rules() { echo -e "${YELLOW}[*] Применение правил...${NC}" - # Удаление старых правил (по входящему порту) + # Удаление старых правил (по входящему порту), включая правила старых версий. iptables -t nat -D PREROUTING -p "$PROTO" --dport "$IN_PORT" -j DNAT --to-destination "$TARGET_IP:$OUT_PORT" 2>/dev/null + iptables -t nat -D PREROUTING -p "$PROTO" --dport "$IN_PORT" -m comment --comment "$KASKAD_COMMENT" -j DNAT --to-destination "$TARGET_IP:$OUT_PORT" 2>/dev/null iptables -D INPUT -p "$PROTO" --dport "$IN_PORT" -j ACCEPT 2>/dev/null + iptables -D INPUT -p "$PROTO" --dport "$IN_PORT" -m comment --comment "$KASKAD_COMMENT" -j ACCEPT 2>/dev/null iptables -D FORWARD -p "$PROTO" -d "$TARGET_IP" --dport "$OUT_PORT" -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT 2>/dev/null + iptables -D FORWARD -p "$PROTO" -d "$TARGET_IP" --dport "$OUT_PORT" -m state --state NEW,ESTABLISHED,RELATED -m comment --comment "$KASKAD_COMMENT" -j ACCEPT 2>/dev/null iptables -D FORWARD -p "$PROTO" -s "$TARGET_IP" --sport "$OUT_PORT" -m state --state ESTABLISHED,RELATED -j ACCEPT 2>/dev/null + iptables -D FORWARD -p "$PROTO" -s "$TARGET_IP" --sport "$OUT_PORT" -m state --state ESTABLISHED,RELATED -m comment --comment "$KASKAD_COMMENT" -j ACCEPT 2>/dev/null # Новые правила - iptables -A INPUT -p "$PROTO" --dport "$IN_PORT" -j ACCEPT - iptables -t nat -A PREROUTING -p "$PROTO" --dport "$IN_PORT" -j DNAT --to-destination "$TARGET_IP:$OUT_PORT" + iptables -A INPUT -p "$PROTO" --dport "$IN_PORT" -m comment --comment "$KASKAD_COMMENT" -j ACCEPT + iptables -t nat -A PREROUTING -p "$PROTO" --dport "$IN_PORT" -m comment --comment "$KASKAD_COMMENT" -j DNAT --to-destination "$TARGET_IP:$OUT_PORT" if ! iptables -t nat -C POSTROUTING -o "$IFACE" -j MASQUERADE 2>/dev/null; then iptables -t nat -A POSTROUTING -o "$IFACE" -j MASQUERADE fi - iptables -A FORWARD -p "$PROTO" -d "$TARGET_IP" --dport "$OUT_PORT" -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT - iptables -A FORWARD -p "$PROTO" -s "$TARGET_IP" --sport "$OUT_PORT" -m state --state ESTABLISHED,RELATED -j ACCEPT + iptables -A FORWARD -p "$PROTO" -d "$TARGET_IP" --dport "$OUT_PORT" -m state --state NEW,ESTABLISHED,RELATED -m comment --comment "$KASKAD_COMMENT" -j ACCEPT + iptables -A FORWARD -p "$PROTO" -s "$TARGET_IP" --sport "$OUT_PORT" -m state --state ESTABLISHED,RELATED -m comment --comment "$KASKAD_COMMENT" -j ACCEPT # Настройка UFW если активен if command -v ufw &> /dev/null && ufw status | grep -q "Status: active"; then @@ -197,10 +202,31 @@ apply_iptables_rules() { netfilter-persistent save > /dev/null echo -e "${GREEN}[SUCCESS] $NAME настроен!${NC}" - echo -e "$PROTO: Вход $IN_PORT -> Выход $TARGET_IP:$OUT_PORT" + echo -e "$PROTO: входящий порт $IN_PORT настроен. Адрес назначения скрыт." + echo -e "Посмотреть параметры правила можно отдельно через пункт 5." read -p "Нажмите Enter для возврата в меню..." } +remove_rule_tuple() { + local d_port="$1" d_proto="$2" d_dest="$3" + local target_ip="${d_dest%:*}" + local target_port="${d_dest#*:}" + + # Удаляем как новые помеченные правила, так и совместимые правила старой версии. + iptables -t nat -D PREROUTING -p "$d_proto" --dport "$d_port" -m comment --comment "$KASKAD_COMMENT" -j DNAT --to-destination "$d_dest" 2>/dev/null || \ + iptables -t nat -D PREROUTING -p "$d_proto" --dport "$d_port" -j DNAT --to-destination "$d_dest" 2>/dev/null || true + iptables -D INPUT -p "$d_proto" --dport "$d_port" -m comment --comment "$KASKAD_COMMENT" -j ACCEPT 2>/dev/null || \ + iptables -D INPUT -p "$d_proto" --dport "$d_port" -j ACCEPT 2>/dev/null || true + iptables -D FORWARD -p "$d_proto" -d "$target_ip" --dport "$target_port" -m state --state NEW,ESTABLISHED,RELATED -m comment --comment "$KASKAD_COMMENT" -j ACCEPT 2>/dev/null || \ + iptables -D FORWARD -p "$d_proto" -d "$target_ip" --dport "$target_port" -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT 2>/dev/null || true + iptables -D FORWARD -p "$d_proto" -s "$target_ip" --sport "$target_port" -m state --state ESTABLISHED,RELATED -m comment --comment "$KASKAD_COMMENT" -j ACCEPT 2>/dev/null || \ + iptables -D FORWARD -p "$d_proto" -s "$target_ip" --sport "$target_port" -m state --state ESTABLISHED,RELATED -j ACCEPT 2>/dev/null || true + + if command -v ufw >/dev/null 2>&1 && ufw status | grep -q "Status: active"; then + ufw delete allow "$d_port/$d_proto" >/dev/null 2>&1 || true + fi +} + # --- СПИСОК ПРАВИЛ --- list_active_rules() { echo -e "\n${CYAN}--- Активные переадресации ---${NC}" @@ -244,19 +270,58 @@ delete_single_rule() { # Разбираем строку IFS=':' read -r d_port d_proto d_dest <<< "${RULES_LIST[$rule_num]}" - local target_ip="${d_dest%:*}" - local target_port="${d_dest#*:}" - - iptables -t nat -D PREROUTING -p "$d_proto" --dport "$d_port" -j DNAT --to-destination "$d_dest" 2>/dev/null - iptables -D INPUT -p "$d_proto" --dport "$d_port" -j ACCEPT 2>/dev/null - iptables -D FORWARD -p "$d_proto" -d "$target_ip" --dport "$target_port" -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT 2>/dev/null - iptables -D FORWARD -p "$d_proto" -s "$target_ip" --sport "$target_port" -m state --state ESTABLISHED,RELATED -j ACCEPT 2>/dev/null + remove_rule_tuple "$d_port" "$d_proto" "$d_dest" netfilter-persistent save > /dev/null echo -e "${GREEN}[OK] Правило удалено.${NC}" read -p "Нажмите Enter..." } +# --- УДАЛЕНИЕ KASKAD --- +uninstall_kaskad() { + echo -e "\n${RED}--- Удаление Kaskad ---${NC}" + echo "Будут удалены команда gokaskad и все показанные Kaskad-переадресации." + echo "Docker, iptables-persistent и системные параметры других служб не удаляются." + echo "" + list_active_rules_no_pause + read -p "Продолжить удаление? Введите DELETE: " confirm + if [[ "$confirm" != "DELETE" ]]; then + echo "Отменено." + read -p "Нажмите Enter..." + return + fi + + while read -r line; do + local d_port d_proto d_dest + d_port=$(echo "$line" | grep -oP '(?<=--dport )\d+') + d_proto=$(echo "$line" | grep -oP '(?<=-p )\w+') + d_dest=$(echo "$line" | grep -oP '(?<=--to-destination )[\d\.:]+') + [[ -n "$d_port" && -n "$d_proto" && -n "$d_dest" ]] || continue + remove_rule_tuple "$d_port" "$d_proto" "$d_dest" + done < <(iptables -t nat -S PREROUTING | grep "DNAT" || true) + + netfilter-persistent save >/dev/null 2>&1 || true + rm -f /usr/local/bin/gokaskad + echo -e "${GREEN}[OK] Kaskad удалён. Текущий файл install.sh оставлен — его можно удалить вручную.${NC}" + exit 0 +} + +list_active_rules_no_pause() { + echo -e "${MAGENTA}ПОРТ (ВХОД)\tПРОТОКОЛ\tЦЕЛЬ (IP:ВЫХОД)${NC}" + local found=0 + while read -r line; do + local l_port l_proto l_dest + l_port=$(echo "$line" | grep -oP '(?<=--dport )\d+') + l_proto=$(echo "$line" | grep -oP '(?<=-p )\w+') + l_dest=$(echo "$line" | grep -oP '(?<=--to-destination )[\d\.:]+') + if [[ -n "$l_port" ]]; then + echo -e "$l_port\t\t$l_proto\t\t$l_dest" + found=1 + fi + done < <(iptables -t nat -S PREROUTING | grep "DNAT" || true) + [[ $found -eq 1 ]] || echo "Нет активных переадресаций." +} + # --- ПОЛНАЯ ОЧИСТКА --- flush_rules() { echo -e "\n${RED}!!! ВНИМАНИЕ !!!${NC}" @@ -292,6 +357,7 @@ show_menu() { echo -e "7) ${RED}Сбросить ВСЕ настройки${NC}" echo -e "8) ${YELLOW}Показать заставку BERLOGA${NC}" echo -e "9) ${MAGENTA}📚 ИНСТРУКЦИЯ (Как настроить)${NC}" + echo -e "10) ${RED}Полностью удалить Kaskad${NC}" echo -e "0) Выход" echo -e "------------------------------------------------------" read -p "Ваш выбор: " choice @@ -306,6 +372,7 @@ show_menu() { 7) flush_rules ;; 8) show_berloga ;; 9) show_instructions ;; + 10) uninstall_kaskad ;; 0) exit 0 ;; *) ;; esac @@ -314,6 +381,11 @@ show_menu() { # --- ЗАПУСК --- check_root + +if [[ "${1:-}" == "--uninstall" ]]; then + uninstall_kaskad +fi + prepare_system show_berloga show_menu