From afd62e8539e9104c428a1a0cc564a422d5b1ceed Mon Sep 17 00:00:00 2001
From: KOMATA <20227709+HynoR@users.noreply.github.com>
Date: Wed, 12 Nov 2025 11:49:24 +0800
Subject: [PATCH] fix: Fix bug in iptables firewall module (#10927)

---
 agent/app/service/firewall.go                  | 12 +++++++++---
 agent/app/service/iptables.go                  |  5 ++++-
 agent/server/server.go                         |  3 ---
 agent/utils/firewall/client/iptables.go        |  6 ++++++
 agent/utils/firewall/client/iptables/common.go |  3 ++-
 core/server/server.go                          |  3 ---
 6 files changed, 21 insertions(+), 11 deletions(-)

diff --git a/agent/app/service/firewall.go b/agent/app/service/firewall.go
index a47cb8f1f..76e0e637e 100644
--- a/agent/app/service/firewall.go
+++ b/agent/app/service/firewall.go
@@ -685,7 +685,7 @@ func (u *FirewallService) updatePingStatus(enable string) error {
 		return fmt.Errorf("failed to write to %s: %v", targetPath, err)
 	}
 
-	if err := cmd.RunDefaultBashCf(applyCmd); err != nil {
+	if err := cmd.RunDefaultBashC(applyCmd); err != nil {
 		global.LOG.Warnf("failed to apply persistent config with '%s': %v", applyCmd, err)
 	}
 
@@ -820,7 +820,10 @@ func checkPortUsed(ports, proto string, apps []portOfApp) string {
 }
 
 func loadInitStatus(clientName, tab string) (bool, bool) {
-	if clientName != "firewalld" || (clientName != "iptables" && tab != "forward") {
+	if clientName == "firewalld" {
+		return true, true
+	}
+	if clientName == "ufw" && tab == "forward" {
 		return true, true
 	}
 	switch tab {
@@ -840,7 +843,10 @@ func loadInitStatus(clientName, tab string) (bool, bool) {
 		if exist, _ := iptables.CheckChainExist(iptables.FilterTab, iptables.Chain1PanelBasicAfter); !exist {
 			return false, false
 		}
-		if exist := iptables.CheckRuleExist(iptables.FilterTab, iptables.Chain1PanelBasicAfter, iptables.DropAll); !exist {
+		if exist := iptables.CheckRuleExist(iptables.FilterTab, iptables.Chain1PanelBasicAfter, iptables.DropAllTcp); !exist {
+			return false, false
+		}
+		if exist := iptables.CheckRuleExist(iptables.FilterTab, iptables.Chain1PanelBasicAfter, iptables.DropAllUdp); !exist {
 			return false, false
 		}
 		if bind, _ := iptables.CheckChainBind(iptables.FilterTab, iptables.ChainInput, iptables.Chain1PanelBasicBefore); !bind {
diff --git a/agent/app/service/iptables.go b/agent/app/service/iptables.go
index bdd04ce8f..9b172cb41 100644
--- a/agent/app/service/iptables.go
+++ b/agent/app/service/iptables.go
@@ -316,7 +316,10 @@ func initPreRules() error {
 			return err
 		}
 	}
-	if err := iptables.AddRule(iptables.FilterTab, iptables.Chain1PanelBasicAfter, iptables.DropAll); err != nil {
+	if err := iptables.AddRule(iptables.FilterTab, iptables.Chain1PanelBasicAfter, iptables.DropAllTcp); err != nil {
+		return err
+	}
+	if err := iptables.AddRule(iptables.FilterTab, iptables.Chain1PanelBasicAfter, iptables.DropAllUdp); err != nil {
 		return err
 	}
 	return nil
diff --git a/agent/server/server.go b/agent/server/server.go
index 5a56fe5fd..8201b4c19 100644
--- a/agent/server/server.go
+++ b/agent/server/server.go
@@ -45,9 +45,6 @@ func Start() {
 	firewall.Init()
 	lang.Init()
 	validator.Init()
-	if os.Getenv("GIN_MODE") == "" {
-		gin.SetMode(gin.ReleaseMode)
-	}
 	cron.Run()
 	hook.Init()
 	InitOthers()
diff --git a/agent/utils/firewall/client/iptables.go b/agent/utils/firewall/client/iptables.go
index 807c0fee2..41f8c6102 100644
--- a/agent/utils/firewall/client/iptables.go
+++ b/agent/utils/firewall/client/iptables.go
@@ -72,6 +72,12 @@ func (i *Iptables) ListPort() ([]FireInfo, error) {
 		if item.Strategy == "drop" || item.Strategy == "reject" {
 			item.Strategy = "drop"
 		}
+		if item.Protocol == "6" {
+			item.Protocol = "tcp"
+		} else if item.Protocol == "17" {
+			item.Protocol = "udp"
+		}
+
 		datas = append(datas, FireInfo{
 			Chain:    item.Chain,
 			Address:  item.SrcIP,
diff --git a/agent/utils/firewall/client/iptables/common.go b/agent/utils/firewall/client/iptables/common.go
index ec9840f6f..9f7922e5f 100644
--- a/agent/utils/firewall/client/iptables/common.go
+++ b/agent/utils/firewall/client/iptables/common.go
@@ -26,7 +26,8 @@ const (
 const (
 	EstablishedRule = "-m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT -m comment --comment 'ESTABLISHED Whitelist'"
 	IoRuleIn        = "-i lo -j ACCEPT -m comment --comment 'Loopback Whitelist'"
-	DropAll         = "-j DROP"
+	DropAllTcp      = "-p tcp -j DROP"
+	DropAllUdp      = "-p udp -j DROP"
 	AllowSSH        = "-p tcp --dport ssh -j ACCEPT"
 )
 
diff --git a/core/server/server.go b/core/server/server.go
index d640a8b30..bd803d1ce 100644
--- a/core/server/server.go
+++ b/core/server/server.go
@@ -40,9 +40,6 @@ func Start() {
 	gob.Register(psession.SessionUser{})
 	cron.Init()
 	session.Init()
-	if os.Getenv("GIN_MODE") == "" {
-		gin.SetMode(gin.ReleaseMode)
-	}
 	hook.Init()
 	InitOthers()