Skip to content
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
46 changes: 23 additions & 23 deletions README.md
Original file line number Diff line number Diff line change
@@ -1,77 +1,77 @@
# firewalld-cloudflare-http

firewalld の ipset + rich rule を使って、HTTP/HTTPS (80/443) Cloudflare IP からのみ許可する RPM パッケージ。
An RPM package that uses firewalld ipset + rich rules to allow HTTP/HTTPS (80/443) only from Cloudflare IPs.

## インストール
## Installation

```bash
# RPM をビルドしてインストール
# Build and install the RPM
make rpm
sudo dnf install ~/rpmbuild/RPMS/noarch/firewalld-cloudflare-http-*.rpm
```

## 動作
## How It Works

インストール時に以下が自動で行われます:
The following steps are performed automatically during installation:

1. Cloudflare の公開 IP リスト ([IPv4](https://www.cloudflare.com/ips-v4), [IPv6](https://www.cloudflare.com/ips-v6)) を取得
2. firewalld ipset (`cloudflare-ipv4`, `cloudflare-ipv6`) を作成
3. デフォルト zone に HTTP/HTTPS を許可する rich rule を追加
4. 週次の systemd timer IP リストを自動更新
1. Fetches Cloudflare's public IP lists ([IPv4](https://www.cloudflare.com/ips-v4), [IPv6](https://www.cloudflare.com/ips-v6))
2. Creates firewalld ipsets (`cloudflare-ipv4`, `cloudflare-ipv6`)
3. Adds rich rules to the default zone to allow HTTP/HTTPS
4. Sets up a weekly systemd timer to automatically update the IP lists

## インストール後の確認
## Post-Installation Verification

```bash
# ipset の確認
# Check ipsets
sudo firewall-cmd --get-ipsets
sudo firewall-cmd --info-ipset=cloudflare-ipv4
sudo firewall-cmd --info-ipset=cloudflare-ipv6

# rich rule の確認
# Check rich rules
sudo firewall-cmd --list-rich-rules

# timer の確認
# Check timer
systemctl status firewalld-cloudflare-http-update.timer
```

## 既存の HTTP/HTTPS サービスの無効化
## Disabling Existing HTTP/HTTPS Services

Cloudflare IP 以外からの HTTP/HTTPS を拒否するには、zone から `http`/`https` サービスを削除してください:
To deny HTTP/HTTPS from non-Cloudflare IPs, remove the `http`/`https` services from the zone:

```bash
sudo firewall-cmd --permanent --remove-service=http
sudo firewall-cmd --permanent --remove-service=https
sudo firewall-cmd --reload
```

## 手動更新
## Manual Update

```bash
# IP リストの手動更新
# Manually update the IP lists
sudo /usr/libexec/firewalld-cloudflare-http/update update

# rich rule の再セットアップ (特定の zone を指定可能)
# Re-run setup (optionally specify a zone)
sudo /usr/libexec/firewalld-cloudflare-http/update setup [zone]
```

## アンインストール
## Uninstallation

```bash
sudo dnf remove firewalld-cloudflare-http
```

アンインストール時に rich rule と ipset は自動で削除されます。
Rich rules and ipsets are automatically removed during uninstallation.

## ビルド要件
## Build Requirements

- `rpmbuild` (`rpm-build` パッケージ)
- `rpmbuild` (`rpm-build` package)
- `make`

```bash
sudo dnf install rpm-build make
make rpm
```

## ライセンス
## License

Apache License 2.0