Skip to content

fix: simplify api-proxy iptables bypass condition #819

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
lpcox merged 2 commits into from
Feb 13, 2026
Merged

fix: simplify api-proxy iptables bypass condition #819

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
7810f6c
Initial plan
Claude Feb 13, 2026
4749cf3
fix: simplify api-proxy iptables bypass condition
Claude Feb 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 2 additions & 4 deletions containers/agent/setup-iptables.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -127,21 +127,19 @@ fi
echo "[iptables] Allow traffic to Squid proxy (${SQUID_IP}:${SQUID_PORT})..."
iptables -t nat -A OUTPUT -d "$SQUID_IP" -j RETURN

# Bypass Squid for api-proxy when API proxy is enabled.
# Bypass Squid for api-proxy when API proxy IP is configured.
# The agent needs to connect directly to api-proxy (not through Squid).
# The api-proxy then routes outbound traffic through Squid to enforce domain whitelisting.
# Architecture: agent -> api-proxy (direct) -> Squid -> internet
# Use AWF_API_PROXY_IP environment variable set by docker-manager (172.30.0.30)
if [ -n "$AWF_ENABLE_API_PROXY" ] && [ -n "$AWF_API_PROXY_IP" ]; then
if [ -n "$AWF_API_PROXY_IP" ]; then
if is_valid_ipv4 "$AWF_API_PROXY_IP"; then
echo "[iptables] Allow direct traffic to api-proxy (${AWF_API_PROXY_IP}) - bypassing Squid..."
# NAT: skip DNAT to Squid for all traffic to api-proxy
iptables -t nat -A OUTPUT -d "$AWF_API_PROXY_IP" -j RETURN
else
echo "[iptables] WARNING: AWF_API_PROXY_IP has invalid format '${AWF_API_PROXY_IP}', skipping api-proxy bypass"
fi
elif [ -n "$AWF_ENABLE_API_PROXY" ]; then
echo "[iptables] WARNING: AWF_ENABLE_API_PROXY is set but AWF_API_PROXY_IP is not set"
fi

# Bypass Squid for host.docker.internal when host access is enabled.
Expand Down