nordvpn-swap.sh

#!/usr/bin/env bash
# Quick hack to replace iptables rules NordVPN inserts (prepends) for 
# INPUT chain. Instead of accepting connection in any states, only allow RELATED and ESTABLISHED.
# i.e -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
# For what ever reason, NordVPN thinks it's good that they can reach your machine and you would be ok with that.
# It doesn't clean up iptables rules if you reconnect several times to NordVPN

set -euo pipefail

function ifs {
    i="$(ip link | awk -F: '$0 !~ "lo|vir|docker|nordlynx|^[^0-9]"{print $2;getline}')"
    echo "$i"
}

function gw {
    gw=$(iptables -S INPUT | grep -v DROP | head -n 1 | awk '{print $4}')
    echo "$gw"
}

function swap {
    local chain=$1
    local if=$2
    local host=$3

    echo "iptables -R INPUT "$chain" -i "$if" -s "$host" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT"
    iptables -R INPUT "$chain" -i "$if" -s "$host" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
}

gw=$(gw)
echo "GW: $gw"

chain=1
for i in $(ifs); do
    swap "$chain" "$i" "$gw"
    ((chain+=1))
done

n_chain=$(iptables -S INPUT | grep -n "nordlynx" | awk -F: '{print $1}' | head -n1)

swap "$n_chain" nordlynx "$gw"