ufw-insert

ufw-insert

#!/bin/sh -eu
# ufw does not allow IPv6 rules to be inserted before IPv4 rules.  As a
# result, "ufw insert 1" does not work for IPv6 addresses.  Replace the
# "ufw" in the actionban entry in /etc/fail2ban/action.d/ufw.conf with
# this script.  Leave actionunban alone.

# Arguments:
# $1 is "insert"
insertpos=$2
blocktype=$3
# $4 is "from"
ip=$5
# $6 is "to"
destination=$7
# $8 is (optionally) "app"
application=${9-}

case "$ip" in
    *:*)
        # This is an IPv6 address.  Find the position of the first IPv6 rule.
        insertpos=$(ufw status numbered | sed -n 's/^\[ *\([0-9]\+\)\].*(v6).*/\1/p' | head -1)
esac

if [ -n "$application" ]
then
    ufw insert "$insertpos" "$blocktype" from "$ip" to "$destination" app "$application"
else
    ufw insert "$insertpos" "$blocktype" from "$ip" to "$destination"
fi