Firewall and FastDL

Let users allow or block IP addresses per server port with iptables rules managed by FeatherWings, and serve game files over HTTP with FastDL and nginx.

Both features are off for users until an administrator turns them on in Settings, Servers:

The node must run FeatherWings (both are FeatherWings features).

Server firewall

On a server’s Firewall page, users with firewall.read see the rules and users with firewall.manage can add, edit and delete them. A rule has:

Wings stores the rules in wings.db and writes them to the PREROUTING chain of the iptables raw table. That table sees the packet before Docker rewrites the destination port, so a rule matches the port players connect to. Allow becomes ACCEPT and Block becomes DROP, and rules are inserted in priority order.

sudo iptables -t raw -L PREROUTING -n --line-numbers

iptables rules do not survive a reboot, so Wings rebuilds all of them from wings.db when it starts. It also removes rules for ports a server no longer has when the server is synced, and all rules of a server when it is deleted. The Sync action on the page reapplies the rules of one server.

To block everyone except a few addresses, add Allow rules for those addresses with a low priority number, then a Block rule for 0.0.0.0/0 with a higher number.

FastDL

FastDL serves files from a server’s folder over plain HTTP with nginx, so players download maps and addons from the web server instead of the game server.

Node setup

1. Set the FastDL port in the node’s Advanced settings in the panel (default 80).

2. Install nginx on the node.

3. In /etc/featherpanel/config.yml, set enabled: true in the fastdl block. The configuration the panel generates already contains the block with the node’s FastDL port and FQDN:

   system:
     fastdl:
       enabled: true
       bind_port: 80
       public_hostname: node.example.com
       nginx_config_path: /etc/nginx/sites-available/featherwings-fastdl

4. Restart Wings.

When at least one server has FastDL on, Wings writes the nginx site to nginx_config_path, links it into /etc/nginx/sites-enabled/ and reloads nginx. It also adds www-data to the featherpanel group so nginx can read the volumes. The port must not be the Wings API port. Set public_hostname to the node FQDN; without it Wings guesses from the Let’s Encrypt certificate path or uses a catch-all server_name.

The generated site uses system.data as its root, so a file is reachable at http://<node>/<server uuid>/<path>. It refuses files ending in .sma, .amxx, .sp, .smx, .cfg, .ini, .log, .bak, .dat, .sql, .sq3, .so, .dll, .php, .zip, .rar, .jar or .sh, and paths containing addons, cfg or logs. Directory listing is on.

Server setup

On the server’s FastDL page (it needs the settings.reinstall permission), pick a folder inside the server, fastdl by default, and click Enable FastDL. The page then shows the URL and a ready command:

sv_downloadurl "http://node.example.com/<server uuid>/fastdl"

Put the command in server.cfg. The port is left out of the URL when it is 80 or when the node sits behind a reverse proxy. The panel remembers the setting and turns FastDL back on in Wings if Wings lost it, for example after a reinstall of the daemon.