使用 nftables 为 Docker 的 SIP 端口配置中国 IP 白名单

ip -brief address
ip route show default
ss -lntup '( sport = :22 or sport = :5060 or sport = :15060 )'

ufw status verbose
nft list tables
iptables -S
ip6tables -S

docker ps --format 'table {{.Names}}\t{{.Ports}}'

CN_SIP_BACKUP="/root/firewall-backups/cn-sip-$(date +%Y%m%d-%H%M%S)"
install -d -m 700 "$CN_SIP_BACKUP"

nft -j list ruleset > "$CN_SIP_BACKUP/nft.before.json"
nft list ruleset > "$CN_SIP_BACKUP/nft.before.txt"
iptables-save > "$CN_SIP_BACKUP/iptables.before"
ip6tables-save > "$CN_SIP_BACKUP/ip6tables.before"
ss -lntu > "$CN_SIP_BACKUP/listeners.before"

command -v nft python3 curl tcpdump

apt-get update
apt-get install -y nftables python3 curl tcpdump

install -d -m 755 /etc/nftables.d
install -d -m 700 /var/lib/cn-sip-firewall

cat > /etc/nftables.d/cn-sip-ports.nft.in <<'NFT'
table inet cn_sip_ports {
    set cn4 {
        type ipv4_addr
        flags interval
        auto-merge
        elements = { __CN_NETWORKS__ }
    }

    counter cn_ipv4_allowed { }
    counter noncn_ipv4_dropped { }
    counter ipv6_dropped { }
    counter outbound_replies { }

    chain cn_only {
        ct direction reply counter name outbound_replies return
        ip saddr @cn4 counter name cn_ipv4_allowed return
        meta nfproto ipv4 counter name noncn_ipv4_dropped drop
        meta nfproto ipv6 counter name ipv6_dropped drop
    }

    chain prerouting {
        type filter hook prerouting priority -150; policy accept;
        iifname "eth0" fib daddr type local meta l4proto { tcp, udp } th dport { 5060, 15060 } jump cn_only
    }
}
NFT

cat > /usr/local/sbin/build-cn-sip-rules <<'PY'
#!/usr/bin/python3
import ipaddress
import pathlib
import sys

if len(sys.argv) != 3:
    raise SystemExit("usage: build-cn-sip-rules INPUT_ZONE OUTPUT_NFT")

source = pathlib.Path(sys.argv[1])
output = pathlib.Path(sys.argv[2])
lines = [line.strip() for line in source.read_text().splitlines() if line.strip()]
networks = [ipaddress.IPv4Network(line, strict=True) for line in lines]

# 针对完整 cn.zone 设置的完整性检查，不用于其他国家或聚合列表。
if not 1000 <= len(networks) <= 50000:
    raise SystemExit("Unexpected CN network count; keep the current rules")
if any(not network.is_global or network.prefixlen < 8 for network in networks):
    raise SystemExit("Unexpected network in CN source list")

merged = list(ipaddress.collapse_addresses(networks))
template = pathlib.Path("/etc/nftables.d/cn-sip-ports.nft.in").read_text()
if template.count("__CN_NETWORKS__") != 1:
    raise SystemExit("Invalid rule template")

elements = ",\n            ".join(map(str, merged))
output.write_text(template.replace("__CN_NETWORKS__", elements))
print(f"source networks: {len(networks)}, merged networks: {len(merged)}")
PY

chmod 750 /usr/local/sbin/build-cn-sip-rules

curl --fail --show-error --silent --location \
  --connect-timeout 10 --max-time 60 --retry 2 \
  https://www.ipdeny.com/ipblocks/data/countries/cn.zone \
  -o /var/lib/cn-sip-firewall/cn.zone.next

/usr/local/sbin/build-cn-sip-rules \
  /var/lib/cn-sip-firewall/cn.zone.next \
  /etc/nftables.d/cn-sip-ports.nft.next

nft -c -f /etc/nftables.d/cn-sip-ports.nft.next

install -m 640 /etc/nftables.d/cn-sip-ports.nft.next \
  /etc/nftables.d/cn-sip-ports.nft
mv /var/lib/cn-sip-firewall/cn.zone.next \
  /var/lib/cn-sip-firewall/cn.zone

cat > /usr/local/sbin/cn-sip-firewall <<'PY'
#!/usr/bin/python3
import fcntl
import pathlib
import subprocess
import sys

NFT = "/usr/sbin/nft"
TABLE = ["inet", "cn_sip_ports"]
RULES = pathlib.Path("/etc/nftables.d/cn-sip-ports.nft")

def run(args, **kwargs):
    return subprocess.run([NFT, *args], check=True, **kwargs)

def main():
    action = sys.argv[1] if len(sys.argv) == 2 else ""
    if action not in ("apply", "check", "remove", "status"):
        raise SystemExit("usage: cn-sip-firewall apply|check|remove|status")

    with open("/run/lock/cn-sip-firewall.lock", "w") as lock:
        fcntl.flock(lock, fcntl.LOCK_EX)
        exists = subprocess.run(
            [NFT, "list", "table", *TABLE],
            stdout=subprocess.DEVNULL,
            stderr=subprocess.DEVNULL,
        ).returncode == 0

        if action == "status":
            run(["-t", "list", "table", *TABLE])
        elif action == "remove":
            if exists:
                run(["delete", "table", *TABLE])
        else:
            rules = RULES.read_text()
            if "flush ruleset" in rules:
                raise SystemExit("Refusing a global ruleset flush")
            transaction = ("delete table inet cn_sip_ports\n" if exists else "") + rules
            run(["-c", "-f", "-"], input=transaction, text=True)
            if action == "apply":
                run(["-f", "-"], input=transaction, text=True)

if __name__ == "__main__":
    main()
PY

chmod 750 /usr/local/sbin/cn-sip-firewall
/usr/local/sbin/cn-sip-firewall check

cat > /etc/systemd/system/cn-sip-firewall.service <<'UNIT'
[Unit]
Description=CN-only inbound TCP/UDP ports 5060 and 15060
DefaultDependencies=no
After=local-fs.target
Before=network-pre.target docker.service shutdown.target
Wants=network-pre.target
Conflicts=shutdown.target

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/usr/local/sbin/cn-sip-firewall apply
ExecReload=/usr/local/sbin/cn-sip-firewall apply
ExecStop=/usr/local/sbin/cn-sip-firewall remove

[Install]
WantedBy=multi-user.target
UNIT

systemd-analyze verify /etc/systemd/system/cn-sip-firewall.service
systemctl daemon-reload

systemd-run --unit=cn-sip-firewall-rollback \
  --on-active=5m --timer-property=AccuracySec=1s \
  /usr/bin/systemctl disable --now cn-sip-firewall.service

systemctl is-active cn-sip-firewall-rollback.timer

systemctl enable --now cn-sip-firewall.service
systemctl status cn-sip-firewall.service --no-pager
/usr/local/sbin/cn-sip-firewall status

ssh -o ControlMaster=no -o ControlPath=none root@203.0.113.10

python3 - "$CN_SIP_BACKUP/nft.before.json" <<'PY'
import json
import pathlib
import subprocess
import sys

def normalize(value):
    if isinstance(value, list):
        return [normalize(item) for item in value]
    if isinstance(value, dict):
        return {
            key: normalize(item)
            for key, item in value.items()
            if key not in ("handle", "packets", "bytes")
        }
    return value

def original_objects(data):
    result = []
    for item in data["nftables"]:
        if "metainfo" in item:
            continue
        value = next(iter(item.values()))
        own = value.get("family") == "inet" and (
            value.get("table") == "cn_sip_ports"
            or ("table" in item and value.get("name") == "cn_sip_ports")
        )
        if not own:
            result.append(item)
    return normalize(result)

before = json.loads(pathlib.Path(sys.argv[1]).read_text())
after = json.loads(subprocess.check_output(["nft", "-j", "list", "ruleset"], text=True))
if original_objects(before) != original_objects(after):
    raise SystemExit("Existing rules changed; inspect the difference before continuing")
print("PASS: original nftables rules are unchanged")
PY

nft list chain inet cn_sip_ports prerouting
nft list chain inet cn_sip_ports cn_only
nft list counters table inet cn_sip_ports

watch -n 2 'nft list counters table inet cn_sip_ports'

# 替换为服务器实际看到的测试来源地址。
TEST_SOURCE_IP=198.51.100.20
nft get element inet cn_sip_ports cn4 "{ $TEST_SOURCE_IP }"

SIP_SERVER_IP=203.0.113.10

for port in 22 443 5060 15060; do
  nc -vz -w 5 "$SIP_SERVER_IP" "$port"
done

python3 - <<'PY'
import socket
import time

server = "203.0.113.10"  # 替换为服务器公网 IP
with socket.socket(socket.AF_INET, socket.SOCK_DGRAM) as client:
    for port in (5060, 15060):
        for _ in range(3):
            client.sendto(b"\r\n", (server, port))
            time.sleep(0.1)
        print(f"sent 3 UDP probes to {server}:{port}")
PY

TEST_SOURCE_IP=198.51.100.20  # 替换为实际测试来源
timeout 20 tcpdump -ni any -q -s 96 \
  "src host $TEST_SOURCE_IP and (tcp or udp)"

systemctl stop cn-sip-firewall-rollback.timer
systemctl is-active cn-sip-firewall-rollback.timer
systemctl is-active cn-sip-firewall-rollback.service

systemctl is-active cn-sip-firewall.service
systemctl is-enabled cn-sip-firewall.service

cat > /usr/local/sbin/update-cn-sip-firewall <<'SH'
#!/bin/bash
set -euo pipefail

exec 9>/run/lock/cn-sip-update.lock
flock -x 9

rules=/etc/nftables.d/cn-sip-ports.nft
zone=/var/lib/cn-sip-firewall/cn.zone

curl --fail --show-error --silent --location \
  --connect-timeout 10 --max-time 60 --retry 2 \
  https://www.ipdeny.com/ipblocks/data/countries/cn.zone \
  -o "$zone.next"

/usr/local/sbin/build-cn-sip-rules "$zone.next" "$rules.next"
cp -a "$rules" "$rules.previous"
chmod 640 "$rules.next"
mv -f "$rules.next" "$rules"

if systemctl reload cn-sip-firewall.service; then
  mv "$zone.next" "$zone"
else
  cp -a "$rules.previous" "$rules.restore"
  mv -f "$rules.restore" "$rules"
  echo "Reload failed; restored saved configuration" >&2
  exit 1
fi
SH

chmod 750 /usr/local/sbin/update-cn-sip-firewall

/usr/local/sbin/update-cn-sip-firewall
/usr/local/sbin/cn-sip-firewall status

systemctl disable --now cn-sip-firewall.service

/usr/local/sbin/cn-sip-firewall remove

nft list tables
systemctl is-enabled cn-sip-firewall.service