1
#!/bin/bash
2
set -e
3

4
# --- Configuration ---
5
# Subnet that will bypass the VPN and use the local WAN (High Reliability)
6
BYPASS_SUBNET="172.19.0.0/16"
7
# Subnet that forces traffic through the VPN or drops it (High Security)
8
KILLSWITCH_SUBNET="172.18.0.0/16"
9

10
# The specific FWMARK that triggers Tailscale's "Escape Hatch" (Rule 5210).
11
BYPASS_MARK="0x80000"
12

13
# Tailscale's internal IP range (CGNAT). Traffic destined here must NOT
14
# be bypassed, or internal DNS (MagicDNS) and peer-to-peer traffic will break.
15
TAILSCALE_CGNAT="100.64.0.0/10"
16

17
# --- Functions ---
18
cleanup() {
19
    echo "Removing exit node bypass rule for $BYPASS_SUBNET..."
20
    sudo iptables -t mangle -D PREROUTING -s "$BYPASS_SUBNET" -j DOCKER_BYPASS_EXCLUSIONS
21
    sudo iptables -t mangle -F DOCKER_BYPASS_EXCLUSIONS
22
    sudo iptables -t mangle -X DOCKER_BYPASS_EXCLUSIONS
23

24
    echo "Removing exit node bypass rule for $KILLSWITCH_SUBNET..."
25
    sudo iptables -t nat -D POSTROUTING -s "$KILLSWITCH_SUBNET" -o tailscale0 -j MASQUERADE
26
    sudo iptables -t filter -D DOCKER-USER -s "$KILLSWITCH_SUBNET" ! -o tailscale0 -j DROP
27
    sudo iptables -D DOCKER-USER -s "$KILLSWITCH_SUBNET" -d "$KILLSWITCH_SUBNET" -j ACCEPT
28
    echo "Cleanup complete."
29
    exit 0
30
}
31

32
setup() {
33
    # --- Part 1: Split Tunneling (Bypass) ---
34
    echo "Setting up exit node bypass for $BYPASS_SUBNET..."
35

36
    # We create a custom chain to handle the logic for what gets marked.
37
    sudo iptables -t mangle -N DOCKER_BYPASS_EXCLUSIONS
38

39
    # 1. EXCLUSIONS: PREVENT BYPASS FOR INTERNAL TRAFFIC
40
    # We exclude the entire Tailscale CGNAT range (100.64.0.0/10).
41
    # This automatically covers MagicDNS, DERP servers, and all other Tailscale peers.
42
    sudo iptables -t mangle -A DOCKER_BYPASS_EXCLUSIONS -d "$TAILSCALE_CGNAT" -j RETURN
43

44
    # Local loopback (localhost) must also remain internal.
45
    sudo iptables -t mangle -A DOCKER_BYPASS_EXCLUSIONS -d 127.0.0.0/8 -j RETURN
46

47
    # 2. MARKING: TRIGGER THE ESCAPE
48
    # Any packet that survived the exclusions above is destined for the public internet.
49
    # We mark it with 0x80000 to hit Linux Rule 5210.
50
    sudo iptables -t mangle -A DOCKER_BYPASS_EXCLUSIONS -j MARK --set-mark "$BYPASS_MARK"
51

52
    # Apply this chain to all traffic originating from the Bypass Subnet
53
    sudo iptables -t mangle -I PREROUTING 1 -s "$BYPASS_SUBNET" -j DOCKER_BYPASS_EXCLUSIONS
54

55
    echo "Bypass rule is active."
56

57
    # --- Part 2: Killswitch (Secure) ---
58
    echo "Setting up exit node killswitch for $KILLSWITCH_SUBNET..."
59

60
    # 1. MASQUERADE: ensure outgoing traffic looks like it comes from the VPN IP
61
    sudo iptables -t nat -A POSTROUTING -s "$KILLSWITCH_SUBNET" -o tailscale0 -j MASQUERADE
62

63
    # 2. DROP LEAKS: The Killswitch
64
    # If traffic from this subnet tries to leave via ANY interface that is NOT tailscale0, drop it.
65
    sudo iptables -t filter -I DOCKER-USER -s "$KILLSWITCH_SUBNET" ! -o tailscale0 -j DROP
66

67
    # 3. ALLOW LOCAL: Allow containers in the secure subnet to talk to each other
68
    sudo iptables -I DOCKER-USER -s "$KILLSWITCH_SUBNET" -d "$KILLSWITCH_SUBNET" -j ACCEPT
69

70
    echo "Killswitch rule is active."
71
}
72

73
# --- Main Logic ---
74
if [[ "$1" == "cleanup" ]]; then
75
    cleanup
76
else
77
    setup
78
fi