package commands

import (
	"provisioner/provisioner"
)

type CloseAllPorts struct {
	CmdRunner provisioner.CmdRunner
}

func (c *CloseAllPorts) Run() error {
	err := c.CmdRunner.Run("iptables", "-I", "INPUT", "-i", "eth0", "-p", "tcp", "-j", "DROP")
	if err != nil {
		return err
	}

	err = c.CmdRunner.Run("iptables", "-I", "INPUT", "-i", "eth1", "-p", "tcp", "-j", "DROP")
	if err != nil {
		return err
	}
	return c.CmdRunner.Run("iptables", "-I", "INPUT", "-i", "lo", "-j", "ACCEPT")
}

func (*CloseAllPorts) Distro() string {
	return provisioner.DistributionOSS
}
package commands

import (
	"provisioner/provisioner"
)

type CloseAllPorts struct {
	CmdRunner provisioner.CmdRunner
}

func (c *CloseAllPorts) Run() error {
	if err := c.dropNewConnections("eth0"); err != nil {
		return err
	}

	if err := c.dropNewConnections("eth1"); err != nil {
		return err
	}

	return c.CmdRunner.Run("iptables", "-I", "INPUT", "-i", "lo", "-j", "ACCEPT")
}

func (c *CloseAllPorts) dropNewConnections(interfaceName string) error {
	if err := c.CmdRunner.Run("iptables", "-I", "INPUT", "-i", interfaceName, "-p", "tcp", "-j", "DROP"); err != nil {
		return err
	}

	return c.CmdRunner.Run("iptables", "-I", "INPUT", "-i", interfaceName, "-m", "conntrack", "--ctstate", "ESTABLISHED,RELATED", "-j", "ACCEPT")
}

func (*CloseAllPorts) Distro() string {
	return provisioner.DistributionOSS
}
Allow traffic to come in on eth0 and eth1 for established connections
Allow traffic to come in on eth0 and eth1 for established connections

* Without this rule app containers cannot communicate with the internet. For example, when pushing a docker app, the container makes a get request to docker hub but the response gets dropped by iptables

[#130758953]
