surshar / claude-code
Claude Code is an agentic coding tool that lives in your terminal, understands your codebase, and helps you code faster by executing routine tasks, explaining complex code, and handling git workflows - all through natural language commands.
Built by Anthropic · github.com/anthropics
| 1 | #!/bin/bash |
| 2 | set -euo pipefail # Exit on error, undefined vars, and pipeline failures |
| 3 | IFS=$'\n\t' # Stricter word splitting |
| 4 | |
| 5 | # Flush existing rules and delete existing ipsets |
| 6 | iptables -F |
| 7 | iptables -X |
| 8 | iptables -t nat -F |
| 9 | iptables -t nat -X |
| 10 | iptables -t mangle -F |
| 11 | iptables -t mangle -X |
| 12 | ipset destroy allowed-domains 2>/dev/null || true |
| 13 | |
| 14 | # First allow DNS and localhost before any restrictions |
| 15 | # Allow outbound DNS |
| 16 | iptables -A OUTPUT -p udp --dport 53 -j ACCEPT |
| 17 | # Allow inbound DNS responses |
| 18 | iptables -A INPUT -p udp --sport 53 -j ACCEPT |
| 19 | # Allow outbound SSH |
| 20 | iptables -A OUTPUT -p tcp --dport 22 -j ACCEPT |
| 21 | # Allow inbound SSH responses |
| 22 | iptables -A INPUT -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT |
| 23 | # Allow localhost |
| 24 | iptables -A INPUT -i lo -j ACCEPT |
| 25 | iptables -A OUTPUT -o lo -j ACCEPT |
| 26 | |
| 27 | # Create ipset with CIDR support |
| 28 | ipset create allowed-domains hash:net |
| 29 | |
| 30 | # Use cached GitHub meta information from mounted volume |
| 31 | CACHE_FILE="/github-meta-cache/meta.json" |
| 32 | |
| 33 | echo "Using cached GitHub IP ranges..." |
| 34 | if [ -f "${CACHE_FILE}" ]; then |
| 35 | gh_ranges=$(cat "${CACHE_FILE}") |
| 36 | |
| 37 | # Verify the cached data is valid |
| 38 | if ! echo "$gh_ranges" | jq -e '.web and .api and .git' >/dev/null; then |
| 39 | echo "ERROR: Cached GitHub API data is invalid" |
| 40 | exit 1 |
| 41 | fi |
| 42 | else |
| 43 | echo "ERROR: No cached GitHub IP ranges found" |
| 44 | exit 1 |
| 45 | fi |
| 46 | |
| 47 | echo "Processing GitHub IPs..." |
| 48 | while read -r cidr; do |
| 49 | if [[ ! "$cidr" =~ ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/[0-9]{1,2}$ ]]; then |
| 50 | echo "ERROR: Invalid CIDR range from GitHub meta: $cidr" |
| 51 | exit 1 |
| 52 | fi |
| 53 | echo "Adding GitHub range $cidr" |
| 54 | ipset add allowed-domains "$cidr" |
| 55 | done < <(echo "$gh_ranges" | jq -r '(.web + .api + .git)[]' | aggregate -q) |
| 56 | |
| 57 | # Resolve and add other allowed domains |
| 58 | for domain in \ |
| 59 | "registry.npmjs.org" \ |
| 60 | "api.anthropic.com" \ |
| 61 | "sentry.io" \ |
| 62 | "statsig.anthropic.com" \ |
| 63 | "statsig.com"; do |
| 64 | echo "Resolving $domain..." |
| 65 | ips=$(dig +short A "$domain") |
| 66 | if [ -z "$ips" ]; then |
| 67 | echo "ERROR: Failed to resolve $domain" |
| 68 | exit 1 |
| 69 | fi |
| 70 | |
| 71 | while read -r ip; do |
| 72 | if [[ ! "$ip" =~ ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$ ]]; then |
| 73 | echo "ERROR: Invalid IP from DNS for $domain: $ip" |
| 74 | exit 1 |
| 75 | fi |
| 76 | echo "Adding $ip for $domain" |
| 77 | ipset add allowed-domains "$ip" |
| 78 | done < <(echo "$ips") |
| 79 | done |
| 80 | |
| 81 | # Get host IP from default route |
| 82 | HOST_IP=$(ip route | grep default | cut -d" " -f3) |
| 83 | if [ -z "$HOST_IP" ]; then |
| 84 | echo "ERROR: Failed to detect host IP" |
| 85 | exit 1 |
| 86 | fi |
| 87 | |
| 88 | HOST_NETWORK=$(echo "$HOST_IP" | sed "s/\.[0-9]*$/.0\/24/") |
| 89 | echo "Host network detected as: $HOST_NETWORK" |
| 90 | |
| 91 | # Set up remaining iptables rules |
| 92 | iptables -A INPUT -s "$HOST_NETWORK" -j ACCEPT |
| 93 | iptables -A OUTPUT -d "$HOST_NETWORK" -j ACCEPT |
| 94 | |
| 95 | # Set default policies to DROP first |
| 96 | # Set default policies to DROP first |
| 97 | iptables -P INPUT DROP |
| 98 | iptables -P FORWARD DROP |
| 99 | iptables -P OUTPUT DROP |
| 100 | |
| 101 | # First allow established connections for already approved traffic |
| 102 | iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT |
| 103 | iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT |
| 104 | |
| 105 | # Then allow only specific outbound traffic to allowed domains |
| 106 | iptables -A OUTPUT -m set --match-set allowed-domains dst -j ACCEPT |
| 107 | |
| 108 | echo "Firewall configuration complete" |
| 109 | echo "Verifying firewall rules..." |
| 110 | if curl --connect-timeout 5 https://example.com >/dev/null 2>&1; then |
| 111 | echo "ERROR: Firewall verification failed - was able to reach https://example.com" |
| 112 | exit 1 |
| 113 | else |
| 114 | echo "Firewall verification passed - unable to reach https://example.com as expected" |
| 115 | fi |
| 116 | |
| 117 | # Verify GitHub API access |
| 118 | if ! curl --connect-timeout 5 https://api.github.com/zen >/dev/null 2>&1; then |
| 119 | echo "ERROR: Firewall verification failed - unable to reach https://api.github.com" |
| 120 | exit 1 |
| 121 | else |
| 122 | echo "Firewall verification passed - able to reach https://api.github.com as expected" |
| 123 | fi |