🌴 Sync 2026-03-05 23:51:42

mnh/files/firewall4.include

@@ -0,0 +1,45 @@
+#!/bin/sh
+
+. /lib/functions/network.sh
+
+nft_insert() {
+	local chain="$1"
+	local position="$2"
+	shift 2
+
+	local line="$(
+		nft list chain inet fw4 "$chain" \
+		| wc \
+		| awk '{print $1 - 4}'
+	)"
+
+	[[ "$position" -lt 0 ]] && position=$(( line + 1 + position + 1 ))
+
+	[[ "$position" -lt 1 ]] && position=1
+	[[ "$position" -gt "$(( line + 1 ))" ]] && position="$(( line + 1 ))"
+
+	nft insert rule inet fw4 "$chain" index $(( position - 1 )) $@
+}
+
+nft_check_and_insert() {
+	local chain="$1"
+	local position="$2"
+	shift 2
+
+	nft list chain inet fw4 "$chain" | grep -q "$*" 2>/dev/null \
+	|| nft_insert "$chain" "$position" $@
+}
+
+main() {
+	nft add chain inet fw4 "mnh"
+
+	network_find_wan wan_iface
+	network_get_device wan_device "$wan_iface"
+	# avoid dead lock in `fw4 reload`
+	wan_zone=$(QUIET=1 ACTION=device OBJECT=$wan_device utpl -S /usr/share/firewall4/main.uc)
+
+	# before REJECT
+	nft_check_and_insert "input_${wan_zone}" -2 jump "mnh" comment \"Hook into mnh input chain\"
+}
+
+main