39 lines
1.5 KiB
Text
39 lines
1.5 KiB
Text
|
# The rules around ramiel's end of the tunnel to halkyon.li (ADR 0039, D9, D17), loaded
|
||
|
|
# by wg-quick as the tunnel comes up and deleted as it goes (wg-halkyon.conf), so they
|
||
|
|
# live exactly as long as it. As /etc/wireguard/wg-halkyon.nft on ramiel (root, 0600).
|
||
|
|
#
|
||
|
|
# A table of their own, apart from ufw's: a packet the table drops is dropped whatever
|
||
|
|
# ufw says, and what it accepts still meets ufw's rules after it.
|
||
|
|
#
|
||
|
|
# - Into the tunnel: new connections to home's Caddy (443, from HAProxy) and sshd (22,
|
||
|
|
# the jump from away), then their replies; nothing else.
|
||
|
|
# - From the tunnel: replies alone, so a taken-over home reaches neither ramiel's sshd
|
||
|
|
# nor Forgejo nor anything else listening here.
|
||
|
|
# - Through the tunnel: nothing; ramiel routes nothing between it and anywhere else.
|
||
|
|
#
|
||
|
|
# IPv4 alone: the tunnel carries no IPv6 (D8).
|
||
|
|
|
||
|
|
# Made and deleted first, so loading this again replaces it whole.
|
||
|
|
table inet halkyon_tunnel {}
|
||
|
|
delete table inet halkyon_tunnel
|
||
|
|
|
||
|
|
table inet halkyon_tunnel {
|
||
|
|
chain input {
|
||
|
|
type filter hook input priority filter - 1; policy accept;
|
||
|
|
iifname "wg-halkyon" ct state established,related accept
|
||
|
|
iifname "wg-halkyon" drop
|
||
|
|
}
|
||
|
|
|
||
|
|
chain output {
|
||
|
|
type filter hook output priority filter - 1; policy accept;
|
||
|
|
oifname "wg-halkyon" ct state established,related accept
|
||
|
|
oifname "wg-halkyon" ip daddr 10.61.97.2 tcp dport { 22, 443 } accept
|
||
|
|
oifname "wg-halkyon" drop
|
||
|
|
}
|
||
|
|
|
||
|
|
chain forward {
|
||
|
|
type filter hook forward priority filter - 1; policy accept;
|
||
|
|
iifname "wg-halkyon" drop
|
||
|
|
oifname "wg-halkyon" drop
|
||
|
|
}
|
||
|
|
}
|