From dada7294dd9d7c953540df8e34c5618f3b225c50 Mon Sep 17 00:00:00 2001
From: ssongliu <sloooop1x@gmail.com>
Date: Mon, 12 Oct 2026 15:54:55 +0800
Subject: [PATCH] fix(firewall): preserve fail2ban priority when binding
 iptables chains (#14039)

Refs #14019
---
 .../utils/firewall/iptables_helper/manager.go | 34 ++++++++++++++-----
 1 file changed, 26 insertions(+), 8 deletions(-)

diff --git a/agent/utils/firewall/iptables_helper/manager.go b/agent/utils/firewall/iptables_helper/manager.go
index 13746aa40..6fd52c4a8 100644
--- a/agent/utils/firewall/iptables_helper/manager.go
+++ b/agent/utils/firewall/iptables_helper/manager.go
@@ -209,18 +209,36 @@ func buildBaseChainBindingsRestoreScript(output string, bind bool) string {
 }
 
 func baseChainBindingCommands(output string, bind bool) []string {
-	lines := make([]string, 0, len(BasicChains())*2)
-	for _, chain := range BasicChains() {
-		binding := "-A " + InputChain + " -j " + chain
-		for _, current := range strings.Split(output, "\n") {
-			if strings.TrimSpace(current) == binding {
-				lines = append(lines, "-D "+InputChain+" -j "+chain)
+	chains := BasicChains()
+	lines := make([]string, 0, len(chains)*2)
+	position, insertAt := 0, 1
+	for _, current := range strings.Split(output, "\n") {
+		current = strings.TrimSpace(current)
+		if !strings.HasPrefix(current, "-A "+InputChain+" ") {
+			continue
+		}
+		if chain := strings.TrimPrefix(current, "-A "+InputChain+" -j "); slices.Contains(chains, chain) {
+			lines = append(lines, "-D "+InputChain+" -j "+chain)
+			continue
+		}
+		position++
+		if !bind {
+			continue
+		}
+		fields, err := shellwords.Parse(current)
+		if err != nil {
+			continue
+		}
+		for index := 2; index+1 < len(fields); index++ {
+			if fields[index] == "-j" && strings.HasPrefix(fields[index+1], "f2b-") {
+				insertAt = position + 1
+				break
 			}
 		}
 	}
 	if bind {
-		for index, chain := range BasicChains() {
-			lines = append(lines, fmt.Sprintf("-I %s %d -j %s", InputChain, index+1, chain))
+		for index, chain := range chains {
+			lines = append(lines, fmt.Sprintf("-I %s %d -j %s", InputChain, insertAt+index, chain))
 		}
 	}
 	return lines