Example Scripts

The agent executes scripts from your script directories — you decide what happens when an IP is whitelisted or revoked. Below are ready-to-use examples for common setups.

Script contract

Every script receives two arguments:

$1 (bash) / $args[0] (PowerShell) — The CIDR to apply or revoke (e.g., 203.0.113.50/32)
$2 (bash) / $args[1] (PowerShell) — A description string (e.g., EntryGuard session abc-123)

Exit code 0 means success. Any other exit code means failure. All stdout/stderr output is captured and sent back to EntryGuard for troubleshooting.

Scripts must use the NN- naming convention (e.g., 01-ufw.sh). See Script Directories for details.

UFW

apply/01-ufw.sh
#!/bin/bash
set -euo pipefail
CIDR="$1"
DESC="${2:-entryguard}"

ufw allow from "$CIDR" to any port 443 comment "entryguard: $DESC"
echo "Allowed $CIDR on port 443"

revoke/01-ufw.sh
#!/bin/bash
set -euo pipefail
CIDR="$1"

ufw delete allow from "$CIDR" to any port 443 || true
echo "Revoked $CIDR on port 443"

iptables

apply/01-iptables.sh
#!/bin/bash
set -euo pipefail
CIDR="$1"
DESC="${2:-entryguard}"

iptables -A INPUT -s "$CIDR" -p tcp --dport 443 -m comment --comment "entryguard: $DESC" -j ACCEPT
echo "Added iptables rule for $CIDR on port 443"

revoke/01-iptables.sh
#!/bin/bash
set -euo pipefail
CIDR="$1"

while iptables -D INPUT -s "$CIDR" -p tcp --dport 443 -j ACCEPT 2>/dev/null; do
    true
done
echo "Removed iptables rules for $CIDR on port 443"

nginx Allowlist

Manages a file of allow directives that you include in your nginx config.

apply/01-nginx.sh
#!/bin/bash
set -euo pipefail
CIDR="$1"
ALLOWLIST="/etc/nginx/conf.d/entryguard-allowlist.conf"

if ! grep -q "allow $CIDR;" "$ALLOWLIST" 2>/dev/null; then
    echo "allow $CIDR;" >> "$ALLOWLIST"
    nginx -t && nginx -s reload
    echo "Added $CIDR to nginx allowlist"
else
    echo "$CIDR already in nginx allowlist"
fi

revoke/01-nginx.sh
#!/bin/bash
set -euo pipefail
CIDR="$1"
ALLOWLIST="/etc/nginx/conf.d/entryguard-allowlist.conf"

if [ -f "$ALLOWLIST" ]; then
    sed -i "/allow ${CIDR//\//\\/};/d" "$ALLOWLIST"
    nginx -t && nginx -s reload
    echo "Removed $CIDR from nginx allowlist"
else
    echo "Allowlist file not found, nothing to revoke"
fi

In your nginx server block, include the allowlist:

location /admin {
    include /etc/nginx/conf.d/entryguard-allowlist.conf;
    deny all;
    # ...
}

Multi-Service Example (UFW + nginx)

A single resource can run multiple scripts. Put them in the same directory with numbered prefixes:

apply/01-ufw.sh
#!/bin/bash
set -euo pipefail
CIDR="$1"

for PORT in 22 443 8080; do
    ufw allow from "$CIDR" to any port "$PORT" comment "entryguard"
done
echo "Allowed $CIDR on ports 22, 443, 8080"

apply/02-nginx.sh
#!/bin/bash
set -euo pipefail
CIDR="$1"
echo "allow $CIDR;" >> /etc/nginx/conf.d/entryguard-allowlist.conf
nginx -t && nginx -s reload
echo "Added $CIDR to nginx allowlist"

revoke/01-ufw.sh
#!/bin/bash
set -euo pipefail
CIDR="$1"

for PORT in 22 443 8080; do
    ufw delete allow from "$CIDR" to any port "$PORT" || true
done
echo "Revoked $CIDR on ports 22, 443, 8080"

revoke/02-nginx.sh
#!/bin/bash
set -euo pipefail
CIDR="$1"
sed -i "\|allow ${CIDR//\//\\/};|d" /etc/nginx/conf.d/entryguard-allowlist.conf
nginx -t && nginx -s reload || true
echo "Removed $CIDR from nginx allowlist"

Windows Firewall

Uses New-NetFirewallRule / Remove-NetFirewallRule to manage inbound rules. Rules are named EntryGuard-<CIDR> for easy identification.

apply\01-firewall.ps1
param(
    [Parameter(Mandatory=$true)][string]$CIDR,
    [string]$Description = "entryguard"
)

$ErrorActionPreference = "Stop"
$RuleName = "EntryGuard-$CIDR"

# Remove existing rule if present (idempotent)
$existing = Get-NetFirewallRule -DisplayName $RuleName -ErrorAction SilentlyContinue
if ($existing) {
    Remove-NetFirewallRule -DisplayName $RuleName
}

New-NetFirewallRule `
    -DisplayName $RuleName `
    -Description $Description `
    -Direction Inbound `
    -Action Allow `
    -Protocol TCP `
    -LocalPort 443 `
    -RemoteAddress $CIDR `
    -Profile Any

Write-Output "Allowed $CIDR on port 443 (rule: $RuleName)"

revoke\01-firewall.ps1
param(
    [Parameter(Mandatory=$true)][string]$CIDR,
    [string]$Description = "entryguard"
)

$ErrorActionPreference = "Stop"
$RuleName = "EntryGuard-$CIDR"

$existing = Get-NetFirewallRule -DisplayName $RuleName -ErrorAction SilentlyContinue
if ($existing) {
    Remove-NetFirewallRule -DisplayName $RuleName
    Write-Output "Revoked $CIDR (removed rule: $RuleName)"
} else {
    Write-Output "Rule $RuleName not found, nothing to revoke"
}

Windows Firewall (Multi-Port)

Whitelist across multiple ports on Windows:

apply\01-firewall.ps1
param(
    [Parameter(Mandatory=$true)][string]$CIDR,
    [string]$Description = "entryguard"
)

$ErrorActionPreference = "Stop"
$Ports = @(22, 443, 3389)

foreach ($Port in $Ports) {
    $RuleName = "EntryGuard-${CIDR}-${Port}"
    $existing = Get-NetFirewallRule -DisplayName $RuleName -ErrorAction SilentlyContinue
    if ($existing) {
        Remove-NetFirewallRule -DisplayName $RuleName
    }
    New-NetFirewallRule `
        -DisplayName $RuleName `
        -Description $Description `
        -Direction Inbound `
        -Action Allow `
        -Protocol TCP `
        -LocalPort $Port `
        -RemoteAddress $CIDR `
        -Profile Any
}

Write-Output "Allowed $CIDR on ports $($Ports -join ', ')"

revoke\01-firewall.ps1
param(
    [Parameter(Mandatory=$true)][string]$CIDR,
    [string]$Description = "entryguard"
)

$ErrorActionPreference = "Stop"
$Ports = @(22, 443, 3389)

foreach ($Port in $Ports) {
    $RuleName = "EntryGuard-${CIDR}-${Port}"
    $existing = Get-NetFirewallRule -DisplayName $RuleName -ErrorAction SilentlyContinue
    if ($existing) {
        Remove-NetFirewallRule -DisplayName $RuleName
    }
}

Write-Output "Revoked $CIDR on ports $($Ports -join ', ')"

MikroTik (RouterOS 7+)

Uses the MikroTik REST API to manage an address list. The agent must be able to reach the router's API (typically on the same LAN). Requires RouterOS 7.1+ with the REST API enabled.

Prerequisites:

Enable the REST API on your MikroTik: /ip/service set www-ssl disabled=no
Create a dedicated user with limited permissions: /user add name=entryguard password=YOUR_PASSWORD group=write
Install curl on the machine running the agent

Configure the router address and credentials in the scripts:

apply/01-mikrotik.sh
#!/bin/bash
set -euo pipefail
CIDR="$1"
DESC="${2:-entryguard}"

# MikroTik connection settings
ROUTER="https://192.168.1.1"
USER="entryguard"
PASS="YOUR_PASSWORD"
LIST="entryguard-allowed"

# Extract IP from CIDR (MikroTik address-list uses address, not CIDR for /32)
ADDRESS="$CIDR"

# Check if already exists
EXISTING=$(curl -sk -u "$USER:$PASS" \
  "$ROUTER/rest/ip/firewall/address-list?list=$LIST&address=$ADDRESS" \
  2>/dev/null | grep -c '"address"' || true)

if [ "$EXISTING" -gt 0 ]; then
    echo "$ADDRESS already in address list $LIST"
    exit 0
fi

# Add to address list
curl -sk -u "$USER:$PASS" \
  -X PUT "$ROUTER/rest/ip/firewall/address-list" \
  -H "Content-Type: application/json" \
  -d "{\"list\":\"$LIST\",\"address\":\"$ADDRESS\",\"comment\":\"$DESC\"}"

echo "Added $ADDRESS to MikroTik address list $LIST"

revoke/01-mikrotik.sh
#!/bin/bash
set -euo pipefail
CIDR="$1"

# MikroTik connection settings
ROUTER="https://192.168.1.1"
USER="entryguard"
PASS="YOUR_PASSWORD"
LIST="entryguard-allowed"

ADDRESS="$CIDR"

# Find the entry ID
ENTRY_ID=$(curl -sk -u "$USER:$PASS" \
  "$ROUTER/rest/ip/firewall/address-list?list=$LIST&address=$ADDRESS" \
  2>/dev/null | grep -o '"\.id":"[^"]*"' | head -1 | cut -d'"' -f4)

if [ -z "$ENTRY_ID" ]; then
    echo "$ADDRESS not found in address list $LIST, nothing to revoke"
    exit 0
fi

# Remove from address list
curl -sk -u "$USER:$PASS" \
  -X DELETE "$ROUTER/rest/ip/firewall/address-list/$ENTRY_ID"

echo "Removed $ADDRESS from MikroTik address list $LIST"

Then in your MikroTik firewall, reference the address list:

/ip firewall filter
add chain=forward src-address-list=entryguard-allowed action=accept comment="EntryGuard allowed IPs"
add chain=forward action=drop comment="Drop all other traffic"

Security

Keep the MikroTik API on the LAN only — never expose it to the internet. The agent runs inside your network and connects to the router locally. EntryGuard never sees your router credentials.

Writing Your Own

Tips for writing reliable scripts:

Fail fast — Use set -euo pipefail (bash) or $ErrorActionPreference = "Stop" (PowerShell)
Make apply idempotent — running twice with the same CIDR should not create duplicate rules
Make revoke safe — revoking a CIDR that isn't present should not fail (use || true or -ErrorAction SilentlyContinue where appropriate)
Print what you did — output is shown in EntryGuard for troubleshooting
Test manually first — run bash apply/01-ufw.sh 203.0.113.50/32 "test" or .\apply\01-firewall.ps1 -CIDR 203.0.113.50/32 -Description "test" before connecting the agent
Keep scripts simple — one concern per script, easy to audit

UFW​

iptables​

nginx Allowlist​

Multi-Service Example (UFW + nginx)​

Windows Firewall​

Windows Firewall (Multi-Port)​

MikroTik (RouterOS 7+)​

Writing Your Own​

UFW