highperfocused/raspiblitz
1
0
Fork 0
mirror of https://github.com/raspiblitz/raspiblitz.git synced 2025-03-27 02:01:53 +01:00
Code Issues Packages Projects Releases Wiki Activity

added firewall config

Browse Source
This commit is contained in:
rootzoll 2018-08-23 01:27:42 +02:00
parent 9a5cb86fc1
commit 1d0d7037e6
2 changed files with 22 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

34
build.sdcard/raspbianStretchDesktop.sh
View File

@ -91,22 +91,30 @@ echo "*** HARDENING ***"
# firewall - just install (not configure)
sudo apt-get install -y ufw
echo "allow: ssh"
ufw allow ssh
echo "allow: bitcoin testnet"
ufw allow 18333
echo "allow: bitcoin mainnet"
ufw allow 8333
echo 'allow: lightning testnet'
ufw allow 19735
echo "allow: lightning mainnet"
ufw allow 9735
echo "deny incoming connection on other ports"
ufw default deny incoming
sudo ufw default deny incoming
echo "allow outgoing connections"
ufw default allow outgoing
sudo ufw default allow outgoing
echo "allow: ssh"
sudo ufw allow ssh
echo "allow: bitcoin testnet"
sudo ufw allow 18333 comment 'bitcoin testnet'
echo "allow: bitcoin mainnet"
sudo ufw allow 8333 comment 'bitcoin mainnet'
echo "allow: litecoin mainnet"
sudo ufw allow 9333 comment 'litecoin mainnet'
echo 'allow: lightning testnet'
sudo ufw allow 19735 comment 'lightning testnet'
echo "allow: lightning mainnet"
sudo ufw allow 9735 comment 'lightning mainnet'
echo "allow: lightning gRPC"
sudo ufw allow 10009 comment 'lightning gRPC'
echo "allow: trasmission"
sudo ufw allow 51413 comment 'transmission'
echo "allow: local web admin"
sudo ufw allow from 192.168.0.0/24 to any port 80 comment 'allow local LAN web'
echo "enable lazy firewall"
ufw enable
sudo ufw enable
# fail2ban (no config required)
sudo apt-get install -y fail2ban

7
home.admin/97-addShango.sh → home.admin/97addMobileWallet.sh
View File

@ -3,13 +3,8 @@
# location of lnd.conf
lnd_config=/home/bitcoin/.lnd/lnd.conf
# we assume usage in LAN -> shango in safe mode
# append config
echo "rpclisten=0.0.0.0:10009" | sudo tee -a ${lnd_config}
# allow in firewall
sudo ufw allow from 192.168.0.0/24 to any port 10009 comment 'allow LND grpc from local LAN'
sudo ufw allow from 0.0.0.0/24 to any port 10009 comment 'allow LND grpc'
# delete certificates as they need to be recreated with correct settings
sudo rm /home/bitcoin/.lnd/tls.*