surshar / claude-code
Claude Code is an agentic coding tool that lives in your terminal, understands your codebase, and helps you code faster by executing routine tasks, explaining complex code, and handling git workflows - all through natural language commands.
Built by Anthropic · github.com/anthropics
| 1 | #!/bin/bash |
| 2 | set -euo pipefail # Exit on error, undefined vars, and pipeline failures |
| 3 | IFS=$'\n\t' # Stricter word splitting |
| 4 | |
| 5 | # 1. Extract Docker DNS info BEFORE any flushing |
| 6 | DOCKER_DNS_RULES=$(iptables-save -t nat | grep "127\.0\.0\.11" || true) |
| 7 | |
| 8 | # Flush existing rules and delete existing ipsets |
| 9 | iptables -F |
| 10 | iptables -X |
| 11 | iptables -t nat -F |
| 12 | iptables -t nat -X |
| 13 | iptables -t mangle -F |
| 14 | iptables -t mangle -X |
| 15 | ipset destroy allowed-domains 2>/dev/null || true |
| 16 | |
| 17 | # 2. Selectively restore ONLY internal Docker DNS resolution |
| 18 | if [ -n "$DOCKER_DNS_RULES" ]; then |
| 19 | echo "Restoring Docker DNS rules..." |
| 20 | iptables -t nat -N DOCKER_OUTPUT 2>/dev/null || true |
| 21 | iptables -t nat -N DOCKER_POSTROUTING 2>/dev/null || true |
| 22 | echo "$DOCKER_DNS_RULES" | xargs -L 1 iptables -t nat |
| 23 | else |
| 24 | echo "No Docker DNS rules to restore" |
| 25 | fi |
| 26 | |
| 27 | # First allow DNS and localhost before any restrictions |
| 28 | # Allow outbound DNS |
| 29 | iptables -A OUTPUT -p udp --dport 53 -j ACCEPT |
| 30 | # Allow inbound DNS responses |
| 31 | iptables -A INPUT -p udp --sport 53 -j ACCEPT |
| 32 | # Allow outbound SSH |
| 33 | iptables -A OUTPUT -p tcp --dport 22 -j ACCEPT |
| 34 | # Allow inbound SSH responses |
| 35 | iptables -A INPUT -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT |
| 36 | # Allow localhost |
| 37 | iptables -A INPUT -i lo -j ACCEPT |
| 38 | iptables -A OUTPUT -o lo -j ACCEPT |
| 39 | |
| 40 | # Create ipset with CIDR support |
| 41 | ipset create allowed-domains hash:net |
| 42 | |
| 43 | # Fetch GitHub meta information and aggregate + add their IP ranges |
| 44 | echo "Fetching GitHub IP ranges..." |
| 45 | gh_ranges=$(curl -s https://api.github.com/meta) |
| 46 | if [ -z "$gh_ranges" ]; then |
| 47 | echo "ERROR: Failed to fetch GitHub IP ranges" |
| 48 | exit 1 |
| 49 | fi |
| 50 | |
| 51 | if ! echo "$gh_ranges" | jq -e '.web and .api and .git' >/dev/null; then |
| 52 | echo "ERROR: GitHub API response missing required fields" |
| 53 | exit 1 |
| 54 | fi |
| 55 | |
| 56 | echo "Processing GitHub IPs..." |
| 57 | while read -r cidr; do |
| 58 | if [[ ! "$cidr" =~ ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/[0-9]{1,2}$ ]]; then |
| 59 | echo "ERROR: Invalid CIDR range from GitHub meta: $cidr" |
| 60 | exit 1 |
| 61 | fi |
| 62 | echo "Adding GitHub range $cidr" |
| 63 | ipset add allowed-domains "$cidr" |
| 64 | done < <(echo "$gh_ranges" | jq -r '(.web + .api + .git)[]' | aggregate -q) |
| 65 | |
| 66 | # Resolve and add other allowed domains |
| 67 | for domain in \ |
| 68 | "registry.npmjs.org" \ |
| 69 | "api.anthropic.com" \ |
| 70 | "sentry.io" \ |
| 71 | "statsig.anthropic.com" \ |
| 72 | "statsig.com" \ |
| 73 | "marketplace.visualstudio.com" \ |
| 74 | "vscode.blob.core.windows.net" \ |
| 75 | "update.code.visualstudio.com"; do |
| 76 | echo "Resolving $domain..." |
| 77 | ips=$(dig +noall +answer A "$domain" | awk '$4 == "A" {print $5}') |
| 78 | if [ -z "$ips" ]; then |
| 79 | echo "ERROR: Failed to resolve $domain" |
| 80 | exit 1 |
| 81 | fi |
| 82 | |
| 83 | while read -r ip; do |
| 84 | if [[ ! "$ip" =~ ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$ ]]; then |
| 85 | echo "ERROR: Invalid IP from DNS for $domain: $ip" |
| 86 | exit 1 |
| 87 | fi |
| 88 | echo "Adding $ip for $domain" |
| 89 | ipset add allowed-domains "$ip" |
| 90 | done < <(echo "$ips") |
| 91 | done |
| 92 | |
| 93 | # Get host IP from default route |
| 94 | HOST_IP=$(ip route | grep default | cut -d" " -f3) |
| 95 | if [ -z "$HOST_IP" ]; then |
| 96 | echo "ERROR: Failed to detect host IP" |
| 97 | exit 1 |
| 98 | fi |
| 99 | |
| 100 | HOST_NETWORK=$(echo "$HOST_IP" | sed "s/\.[0-9]*$/.0\/24/") |
| 101 | echo "Host network detected as: $HOST_NETWORK" |
| 102 | |
| 103 | # Set up remaining iptables rules |
| 104 | iptables -A INPUT -s "$HOST_NETWORK" -j ACCEPT |
| 105 | iptables -A OUTPUT -d "$HOST_NETWORK" -j ACCEPT |
| 106 | |
| 107 | # Set default policies to DROP first |
| 108 | iptables -P INPUT DROP |
| 109 | iptables -P FORWARD DROP |
| 110 | iptables -P OUTPUT DROP |
| 111 | |
| 112 | # First allow established connections for already approved traffic |
| 113 | iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT |
| 114 | iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT |
| 115 | |
| 116 | # Then allow only specific outbound traffic to allowed domains |
| 117 | iptables -A OUTPUT -m set --match-set allowed-domains dst -j ACCEPT |
| 118 | |
| 119 | # Explicitly REJECT all other outbound traffic for immediate feedback |
| 120 | iptables -A OUTPUT -j REJECT --reject-with icmp-admin-prohibited |
| 121 | |
| 122 | echo "Firewall configuration complete" |
| 123 | echo "Verifying firewall rules..." |
| 124 | if curl --connect-timeout 5 https://example.com >/dev/null 2>&1; then |
| 125 | echo "ERROR: Firewall verification failed - was able to reach https://example.com" |
| 126 | exit 1 |
| 127 | else |
| 128 | echo "Firewall verification passed - unable to reach https://example.com as expected" |
| 129 | fi |
| 130 | |
| 131 | # Verify GitHub API access |
| 132 | if ! curl --connect-timeout 5 https://api.github.com/zen >/dev/null 2>&1; then |
| 133 | echo "ERROR: Firewall verification failed - unable to reach https://api.github.com" |
| 134 | exit 1 |
| 135 | else |
| 136 | echo "Firewall verification passed - able to reach https://api.github.com as expected" |
| 137 | fi |