Update CHANGELOG.md with release date for version 0.4.0

CHANGELOG.md

@@ -1,4 +1,4 @@
-## 0.4.0 (soon)
+## 0.4.0 (11.1.2026)
 ***
 #### Русский
 * Удалён параметр options.docker_support из файла firewall.toml. Настройки от Docker перенесены в файл docker.toml.
@@ -8,6 +8,7 @@
 * Исправлена ошибка:
   * Настройка binaryLocations.docker не работала.
   * Программа аварийно завершалась после остановки Docker'а.
+  * Указанные в настройках IP-адреса не блокировались во время перенаправления в контейнер Docker.
 ***
 #### English
 * Removed the options.docker_support parameter from firewall.toml. Docker settings have been moved to the docker.toml file.
@@ -17,6 +18,7 @@
 * Fixed error:
   * The binaryLocations.docker setting did not work.
   * The program crashed after Docker was stopped.
+  * The IP addresses specified in the settings were not blocked during redirection to the Docker container.
 ***
 ## 0.3.0 (4.1.2026)
 ***

internal/daemon/firewall/chain/chains.go

@@ -27,6 +27,9 @@ type Chains interface {
 	NewLocalOutput() error
 	LocalOutput() LocalOutput
 
+	NewLocalForward() error
+	LocalForward() LocalForward
+
 	ClearRules() error
 
 	NewNoneChain(chain string) (Chain, error)
@@ -39,8 +42,9 @@ type chains struct {
 	forward      Forward
 	packetFilter PacketFilter
 
-	localInput  LocalInput
-	localOutput LocalOutput
+	localInput   LocalInput
+	localOutput  LocalOutput
+	localForward LocalForward
 
 	family nftFamily.Type
 	table  string
@@ -147,6 +151,19 @@ func (c *chains) LocalOutput() LocalOutput {
 	return c.localOutput
 }
 
+func (c *chains) NewLocalForward() error {
+	localForward, err := newLocalForward(c.nft, c.family, c.table)
+	if err != nil {
+		return err
+	}
+	c.localForward = localForward
+	return nil
+}
+
+func (c *chains) LocalForward() LocalForward {
+	return c.localForward
+}
+
 func (c *chains) ClearRules() error {
 	return clearRules(c.nft, c.family, c.table)
 }

internal/daemon/firewall/chain/local_forward.go

@@ -0,0 +1,41 @@
+package chain
+
+import (
+	nft "git.kor-elf.net/kor-elf-shield/go-nftables-client"
+	nftChain "git.kor-elf.net/kor-elf-shield/go-nftables-client/chain"
+	"git.kor-elf.net/kor-elf-shield/go-nftables-client/family"
+)
+
+type LocalForward interface {
+	AddRule(expr ...string) error
+	AddRuleIn(AddRuleFunc func(expr ...string) error) error
+}
+
+type localForward struct {
+	nft    nft.NFT
+	family family.Type
+	table  string
+	chain  string
+}
+
+func newLocalForward(nft nft.NFT, family family.Type, table string) (LocalForward, error) {
+	chain := "local-forward"
+	if err := nft.Chain().Add(family, table, chain, nftChain.TypeNone); err != nil {
+		return nil, err
+	}
+
+	return &localForward{
+		nft:    nft,
+		family: family,
+		table:  table,
+		chain:  chain,
+	}, nil
+}
+
+func (l *localForward) AddRule(expr ...string) error {
+	return l.nft.Rule().Add(l.family, l.table, l.chain, expr...)
+}
+
+func (l *localForward) AddRuleIn(AddRuleFunc func(expr ...string) error) error {
+	return AddRuleFunc("iifname != \"lo\" counter jump " + l.chain)
+}

internal/daemon/firewall/reload_forward.go

@@ -8,6 +8,10 @@ func (f *firewall) reloadForward() error {
 	}
 	chain := f.chains.Forward()
 
+	if err := f.reloadForwardAddIPs(); err != nil {
+		return err
+	}
+
 	if f.config.Options.DockerSupport {
 		if err := f.docker.NftChains().ForwardFilterJump(chain.AddRule); err != nil {
 			return err
@@ -23,3 +27,53 @@ func (f *firewall) reloadForward() error {
 
 	return nil
 }
+
+func (f *firewall) reloadForwardAddIPs() error {
+	if err := f.chains.NewLocalForward(); err != nil {
+		return err
+	}
+	chain := f.chains.LocalForward()
+	if err := chain.AddRuleIn(f.chains.Forward().AddRule); err != nil {
+		return err
+	}
+
+	for _, ipConfig := range f.config.IP4.InIPs {
+		if ipConfig.Action != ActionDrop && ipConfig.Action != ActionReject {
+			continue
+		}
+		if err := forwardAddIP(chain.AddRule, ipConfig, "ip"); err != nil {
+			return err
+		}
+	}
+
+	if !f.config.IP6.Enable {
+		return nil
+	}
+
+	for _, ipConfig := range f.config.IP6.InIPs {
+		if ipConfig.Action != ActionDrop && ipConfig.Action != ActionReject {
+			continue
+		}
+		if err := forwardAddIP(chain.AddRule, ipConfig, "ip6"); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func forwardAddIP(addRuleFunc func(expr ...string) error, config ConfigIP, ipMatch string) error {
+	rule := ipMatch + " saddr " + config.IP + " iifname != \"lo\""
+
+	// There, during routing, the port changes and then the IP blocking rule will not work.
+	//if !config.OnlyIP {
+	//	rule += " " + config.Protocol.String() + " dport " + strconv.Itoa(int(config.Port))
+	//}
+
+	rule += " counter " + config.Action.String()
+	if err := addRuleFunc(rule); err != nil {
+		return err
+	}
+
+	return nil
+}