fix: Fix iptables state persistence issue (#11137)

Refs #11126

agent/app/service/iptables.go

@@ -8,6 +8,7 @@ import (
 
 	"github.com/1Panel-dev/1Panel/agent/app/dto"
 	"github.com/1Panel-dev/1Panel/agent/app/model"
+	"github.com/1Panel-dev/1Panel/agent/constant"
 	"github.com/1Panel-dev/1Panel/agent/global"
 	"github.com/1Panel-dev/1Panel/agent/utils/cmd"
 	"github.com/1Panel-dev/1Panel/agent/utils/firewall/client"
@@ -189,9 +190,14 @@ func (s *IptablesService) Operate(req dto.IptablesOp) error {
 		if err := iptables.SaveRulesToFile(iptables.FilterTab, iptables.Chain1PanelBasicAfter, iptables.BasicAfterFileName); err != nil {
 			return err
 		}
+		_ = settingRepo.Update("IptablesStatus", constant.StatusEnable)
 		return nil
 	case "init-forward":
-		return client.EnableIptablesForward()
+		if err := client.EnableIptablesForward(); err != nil {
+			return err
+		}
+		_ = settingRepo.Update("IptablesForwardStatus", constant.StatusEnable)
+		return nil
 	case "init-advance":
 		if err := iptables.AddChain(iptables.FilterTab, iptables.Chain1PanelInput); err != nil {
 			return err
@@ -206,6 +212,8 @@ func (s *IptablesService) Operate(req dto.IptablesOp) error {
 		if err := iptables.BindChain(iptables.FilterTab, iptables.ChainInput, iptables.Chain1PanelInput, number); err != nil {
 			return err
 		}
+		_ = settingRepo.Update("IptablesInputStatus", constant.StatusEnable)
+		_ = settingRepo.Update("IptablesOutputStatus", constant.StatusEnable)
 		return nil
 	case "bind-base":
 		if err := initPreRules(); err != nil {
@@ -220,6 +228,7 @@ func (s *IptablesService) Operate(req dto.IptablesOp) error {
 		if err := iptables.BindChain(iptables.FilterTab, iptables.ChainInput, iptables.Chain1PanelBasicAfter, 3); err != nil {
 			return err
 		}
+		_ = settingRepo.Update("IptablesStatus", constant.StatusEnable)
 		return nil
 	case "unbind-base":
 		if err := iptables.UnbindChain(iptables.FilterTab, iptables.ChainInput, iptables.Chain1PanelBasicAfter); err != nil {
@@ -231,16 +240,29 @@ func (s *IptablesService) Operate(req dto.IptablesOp) error {
 		if err := iptables.UnbindChain(iptables.FilterTab, iptables.ChainInput, iptables.Chain1PanelBasic); err != nil {
 			return err
 		}
+		_ = settingRepo.Update("IptablesStatus", constant.StatusDisable)
 		return nil
 	case "bind":
 		if err := iptables.BindChain(iptables.FilterTab, targetChain, req.Name, loadBindNumber(req.Name)); err != nil {
 			return err
 		}
+		if req.Name == iptables.Chain1PanelInput {
+			_ = settingRepo.Update("IptablesInputStatus", constant.StatusEnable)
+		}
+		if req.Name == iptables.Chain1PanelOutput {
+			_ = settingRepo.Update("IptablesOutputStatus", constant.StatusEnable)
+		}
 		return nil
 	case "unbind":
 		if err := iptables.UnbindChain(iptables.FilterTab, targetChain, req.Name); err != nil {
 			return err
 		}
+		if req.Name == iptables.Chain1PanelInput {
+			_ = settingRepo.Update("IptablesInputStatus", constant.StatusDisable)
+		}
+		if req.Name == iptables.Chain1PanelOutput {
+			_ = settingRepo.Update("IptablesOutputStatus", constant.StatusDisable)
+		}
 		return nil
 	}
 	return nil

agent/init/firewall/firewall.go

@@ -2,9 +2,12 @@ package firewall
 
 import (
 	"fmt"
+	"os"
 
 	"github.com/1Panel-dev/1Panel/agent/app/dto"
+	"github.com/1Panel-dev/1Panel/agent/app/repo"
 	"github.com/1Panel-dev/1Panel/agent/app/service"
+	"github.com/1Panel-dev/1Panel/agent/constant"
 	"github.com/1Panel-dev/1Panel/agent/global"
 	"github.com/1Panel-dev/1Panel/agent/utils/firewall"
 	firewallClient "github.com/1Panel-dev/1Panel/agent/utils/firewall/client"
@@ -12,11 +15,17 @@ import (
 )
 
 func Init() {
+	if !needInit() {
+		return
+	}
+	global.LOG.Info("initializing firewall settings...")
 	client, err := firewall.NewFirewallClient()
 	if err != nil {
 		return
 	}
 	clientName := client.Name()
+
+	settingRepo := repo.NewISettingRepo()
 	if clientName == "ufw" || clientName == "iptables" {
 		if err := iptables.LoadRulesFromFile(iptables.FilterTab, iptables.Chain1PanelForward, iptables.ForwardFileName); err != nil {
 			global.LOG.Errorf("load forward rules from file failed, err: %v", err)
@@ -30,12 +39,17 @@ func Init() {
 			global.LOG.Errorf("load postrouting rules from file failed, err: %v", err)
 			return
 		}
-		if err := firewallClient.EnableIptablesForward(); err != nil {
-			global.LOG.Errorf("enable iptables forward failed, err: %v", err)
-			return
-		}
 		global.LOG.Infof("loaded iptables rules for forward from file successfully")
+
+		iptablesForwardStatus, _ := settingRepo.GetValueByKey("IptablesForwardStatus")
+		if iptablesForwardStatus == constant.StatusEnable {
+			if err := firewallClient.EnableIptablesForward(); err != nil {
+				global.LOG.Errorf("enable iptables forward failed, err: %v", err)
+				return
+			}
+		}
 	}
+
 	if clientName == "ufw" {
 		_ = iptables.UnbindChain(iptables.FilterTab, iptables.ChainInput, iptables.Chain1PanelBasicAfter)
 		_ = iptables.UnbindChain(iptables.FilterTab, iptables.ChainInput, iptables.Chain1PanelBasicBefore)
@@ -43,52 +57,73 @@ func Init() {
 		_ = iptables.UnbindChain(iptables.FilterTab, iptables.ChainInput, iptables.Chain1PanelInput)
 		_ = iptables.UnbindChain(iptables.FilterTab, iptables.ChainOutput, iptables.Chain1PanelOutput)
 	}
-	if clientName == "iptables" {
-		if err := iptables.LoadRulesFromFile(iptables.FilterTab, iptables.Chain1PanelBasicBefore, iptables.BasicBeforeFileName); err != nil {
-			global.LOG.Errorf("load basic before rules from file failed, err: %v", err)
-			return
-		}
-		if err := iptables.LoadRulesFromFile(iptables.FilterTab, iptables.Chain1PanelBasic, iptables.BasicFileName); err != nil {
-			global.LOG.Errorf("load basic rules from file failed, err: %v", err)
-			return
-		}
-		if err := iptables.LoadRulesFromFile(iptables.FilterTab, iptables.Chain1PanelBasicAfter, iptables.BasicAfterFileName); err != nil {
-			global.LOG.Errorf("load basic after rules from file failed, err: %v", err)
-			return
-		}
-		if err := iptables.LoadRulesFromFile(iptables.FilterTab, iptables.Chain1PanelInput, iptables.InputFileName); err != nil {
-			global.LOG.Errorf("load input rules from file failed, err: %v", err)
-			return
-		}
-		if err := iptables.LoadRulesFromFile(iptables.FilterTab, iptables.Chain1PanelOutput, iptables.OutputFileName); err != nil {
-			global.LOG.Errorf("load output rules from file failed, err: %v", err)
-			return
-		}
-		global.LOG.Infof("loaded iptables rules for basic, input and output from file successfully")
 
-		panelPort := service.LoadPanelPort()
+	if err := iptables.LoadRulesFromFile(iptables.FilterTab, iptables.Chain1PanelBasicBefore, iptables.BasicBeforeFileName); err != nil {
-		if len(panelPort) == 0 {
+		global.LOG.Errorf("load basic before rules from file failed, err: %v", err)
-			global.LOG.Errorf("find 1panel service port failed")
+		return
-			return
+	}
-		}
+	if err := iptables.LoadRulesFromFile(iptables.FilterTab, iptables.Chain1PanelBasic, iptables.BasicFileName); err != nil {
-		if err := iptables.AddRule(iptables.FilterTab, iptables.Chain1PanelBasicBefore, fmt.Sprintf("-p tcp -m tcp --dport %v -j ACCEPT", panelPort)); err != nil {
+		global.LOG.Errorf("load basic rules from file failed, err: %v", err)
-			global.LOG.Errorf("add port accept rule %v failed, err: %v", panelPort, err)
+		return
-			return
+	}
-		}
+	if err := iptables.LoadRulesFromFile(iptables.FilterTab, iptables.Chain1PanelBasicAfter, iptables.BasicAfterFileName); err != nil {
-
+		global.LOG.Errorf("load basic after rules from file failed, err: %v", err)
-		iptablesService := service.IptablesService{}
+		return
+	}
+	panelPort := service.LoadPanelPort()
+	if len(panelPort) == 0 {
+		global.LOG.Errorf("find 1panel service port failed")
+		return
+	}
+	if err := iptables.AddRule(iptables.FilterTab, iptables.Chain1PanelBasicBefore, fmt.Sprintf("-p tcp -m tcp --dport %v -j ACCEPT", panelPort)); err != nil {
+		global.LOG.Errorf("add port accept rule %v failed, err: %v", panelPort, err)
+		return
+	}
+	global.LOG.Infof("loaded iptables rules for basic from file successfully")
+	iptablesService := service.IptablesService{}
+	iptablesStatus, _ := settingRepo.GetValueByKey("IptablesStatus")
+	if iptablesStatus == constant.StatusEnable {
 		if err := iptablesService.Operate(dto.IptablesOp{Operate: "bind-base"}); err != nil {
 			global.LOG.Errorf("bind base chains failed, err: %v", err)
 			return
 		}
-		if err := iptablesService.Operate(dto.IptablesOp{Name: iptables.Chain1PanelOutput, Operate: "bind"}); err != nil {
+	}
-			global.LOG.Errorf("bind output chains failed, err: %v", err)
+
-			return
+	if err := iptables.LoadRulesFromFile(iptables.FilterTab, iptables.Chain1PanelInput, iptables.InputFileName); err != nil {
-		}
+		global.LOG.Errorf("load input rules from file failed, err: %v", err)
+		return
+	}
+	if err := iptables.LoadRulesFromFile(iptables.FilterTab, iptables.Chain1PanelOutput, iptables.OutputFileName); err != nil {
+		global.LOG.Errorf("load output rules from file failed, err: %v", err)
+		return
+	}
+	global.LOG.Infof("loaded iptables rules for input and output from file successfully")
+	iptablesInputStatus, _ := settingRepo.GetValueByKey("IptablesInputStatus")
+	if iptablesInputStatus == constant.StatusEnable {
 		if err := iptablesService.Operate(dto.IptablesOp{Name: iptables.Chain1PanelInput, Operate: "bind"}); err != nil {
 			global.LOG.Errorf("bind input chains failed, err: %v", err)
 			return
 		}
 	}
-
+	iptablesOutputStatus, _ := settingRepo.GetValueByKey("IptablesOutputStatus")
+	if iptablesOutputStatus == constant.StatusEnable {
+		if err := iptablesService.Operate(dto.IptablesOp{Name: iptables.Chain1PanelOutput, Operate: "bind"}); err != nil {
+			global.LOG.Errorf("bind output chains failed, err: %v", err)
+			return
+		}
+	}
+}
+
+func needInit() bool {
+	file, err := os.OpenFile("/run/1panel_boot_mark", os.O_RDWR|os.O_CREATE|os.O_EXCL, 0644)
+	if err != nil {
+		if os.IsExist(err) {
+			return false
+		}
+		global.LOG.Errorf("check boot mark file failed: %v", err)
+		return true
+	}
+	defer file.Close()
+	fmt.Fprintf(file, "Boot Mark for 1panel\n")
+	return true
 }

agent/init/migration/migrate.go

@@ -56,6 +56,7 @@ func InitAgentDB() {
 		migrations.UpdateDatabase,
 		migrations.AddGPUMonitor,
 		migrations.UpdateDatabaseMysql,
+		migrations.InitIptablesStatus,
 	})
 	if err := m.Migrate(); err != nil {
 		global.LOG.Error(err)

agent/init/migration/migrations/init.go

@@ -756,3 +756,22 @@ var UpdateDatabaseMysql = &gormigrate.Migration{
 		return nil
 	},
 }
+
+var InitIptablesStatus = &gormigrate.Migration{
+	ID: "20251201-init-iptables-status",
+	Migrate: func(tx *gorm.DB) error {
+		if err := tx.Create(&model.Setting{Key: "IptablesStatus", Value: constant.StatusDisable}).Error; err != nil {
+			return err
+		}
+		if err := tx.Create(&model.Setting{Key: "IptablesForwardStatus", Value: constant.StatusDisable}).Error; err != nil {
+			return err
+		}
+		if err := tx.Create(&model.Setting{Key: "IptablesInputStatus", Value: constant.StatusDisable}).Error; err != nil {
+			return err
+		}
+		if err := tx.Create(&model.Setting{Key: "IptablesOutputStatus", Value: constant.StatusDisable}).Error; err != nil {
+			return err
+		}
+		return nil
+	},
+}