porta-rs 0.1.1

Zero-trust CGNAT bypass via WireGuard tunnel
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82

use anyhow::Result;
use clap::Args;

use crate::config::{load_config, PortMapping, Protocol, Role};
use crate::ufw::rules::UfwManager;

#[derive(Args)]
pub struct AddPortArgs {
    /// Remote port to listen on (public side)
    #[arg(short, long)]
    pub remote: u16,

    /// Local port to forward to
    #[arg(short, long)]
    pub local: u16,

    /// Protocol: tcp or udp
    #[arg(short, long, default_value = "tcp")]
    pub protocol: Protocol,

    /// Description for this port mapping
    #[arg(short, long, default_value = "")]
    pub desc: String,

    /// Skip UFW rule creation
    #[arg(long)]
    pub no_ufw: bool,
}

pub fn execute(args: &AddPortArgs) -> Result<()> {
    let mut config = load_config()?;

    // Check if remote port is already in use
    if config.ports().iter().any(|p| p.remote_port == args.remote && p.protocol == args.protocol) {
        return Err(anyhow::anyhow!(
            "Remote port {} ({}) is already in use",
            args.remote,
            args.protocol
        ));
    }

    let id = format!("port-{}", args.remote);
    let mapping = PortMapping {
        id: id.clone(),
        local_port: args.local,
        remote_port: args.remote,
        protocol: args.protocol.clone(),
        description: args.desc.clone(),
        enabled: true,
    };

    config.ports_mut().push(mapping);
    config.save()?;

    // Add UFW rule if on server
    if config.role() == Role::Server && !args.no_ufw {
        let ufw = UfwManager::new();
        if ufw.is_active() {
            match ufw.allow_port(args.remote, &args.protocol) {
                Ok(()) => {
                    println!("\x1b[1;32m✓ UFW rule added: allow {} {}\x1b[0m", args.remote, args.protocol);
                }
                Err(e) => {
                    println!("\x1b[1;33m⚠ Failed to add UFW rule: {}\x1b[0m", e);
                }
            }
        } else {
            println!("\x1b[1;33m⚠ UFW is not active, skipping firewall rule\x1b[0m");
        }
    }

    println!("\n\x1b[1;32m✓ Port forwarding added:\x1b[0m");
    println!("  Remote:  :{} ({})", args.remote, args.protocol);
    println!("  Local:   localhost:{}", args.local);
    println!("  ID:      {}", id);
    if !args.desc.is_empty() {
        println!("  Desc:    {}", args.desc);
    }
    println!();

    Ok(())
}