45 lines
1.8 KiB
Text
45 lines
1.8 KiB
Text
|
# The rules around home's end of the tunnel from ramiel (ADR 0039, D9, D17), loaded by
|
||
|
|
# wg-quick as the tunnel comes up and deleted as it goes (wg-halkyon.conf), so they live
|
||
|
|
# exactly as long as it. As /etc/wireguard/wg-halkyon.nft on the instance's host at home
|
||
|
|
# (root, 0600).
|
||
|
|
#
|
||
|
|
# A table of its own, apart from Docker's and ufw's, at a priority before theirs: what it
|
||
|
|
# drops is dropped whatever they say, and what it accepts still meets their rules after
|
||
|
|
# it.
|
||
|
|
#
|
||
|
|
# - To the host: new connections from ramiel to sshd alone (22, the jump from away),
|
||
|
|
# then replies.
|
||
|
|
# - Through the host: new connections from ramiel to Caddy's 443 alone (172.30.80.2 on
|
||
|
|
# edge, where Docker has sent the tunnel address's 443 by then), then replies;
|
||
|
|
# nothing to the home network, the other containers or anywhere else.
|
||
|
|
# - Towards ramiel: replies alone.
|
||
|
|
#
|
||
|
|
# IPv4 alone: the tunnel carries no IPv6 (D8).
|
||
|
|
|
||
|
|
# Made and deleted first, so loading this again replaces it whole.
|
||
|
|
table inet halkyon_tunnel {}
|
||
|
|
delete table inet halkyon_tunnel
|
||
|
|
|
||
|
|
table inet halkyon_tunnel {
|
||
|
|
chain input {
|
||
|
|
type filter hook input priority filter - 1; policy accept;
|
||
|
|
iifname "wg-halkyon" ct state established,related accept
|
||
|
|
iifname "wg-halkyon" ip saddr 10.61.97.1 tcp dport 22 accept
|
||
|
|
iifname "wg-halkyon" drop
|
||
|
|
}
|
||
|
|
|
||
|
|
chain forward {
|
||
|
|
type filter hook forward priority filter - 1; policy accept;
|
||
|
|
iifname "wg-halkyon" ct state established,related accept
|
||
|
|
iifname "wg-halkyon" ip saddr 10.61.97.1 ip daddr 172.30.80.2 tcp dport 443 accept
|
||
|
|
iifname "wg-halkyon" drop
|
||
|
|
oifname "wg-halkyon" ct state established,related accept
|
||
|
|
oifname "wg-halkyon" drop
|
||
|
|
}
|
||
|
|
|
||
|
|
chain output {
|
||
|
|
type filter hook output priority filter - 1; policy accept;
|
||
|
|
oifname "wg-halkyon" ct state established,related accept
|
||
|
|
oifname "wg-halkyon" drop
|
||
|
|
}
|
||
|
|
}
|