Tizian 「ティツィアーン」
3f6581d6e2
Ubuntu 26.04 confines wg-quick in an AppArmor profile whose nft sub-profile may read nothing in /etc/wireguard, so the tunnel failed to come up at home. The unit's drop-in (wg-quick-halkyon.conf, before-docker.conf before) loads the rules before the interface exists and deletes them after it is gone, so the tunnel never runs without them. ramiel, on 24.04, keeps PostUp. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
45 lines
1.8 KiB
Text
45 lines
1.8 KiB
Text
# The rules around home's end of the tunnel from ramiel (ADR 0039, D9, D17), loaded by
|
|
# systemd before the tunnel comes up and deleted after it goes (wg-quick-halkyon.conf),
|
|
# so it never runs without them. As /etc/wireguard/wg-halkyon.nft on the instance's host at home
|
|
# (root, 0600).
|
|
#
|
|
# A table of its own, apart from Docker's and ufw's, at a priority before theirs: what it
|
|
# drops is dropped whatever they say, and what it accepts still meets their rules after
|
|
# it.
|
|
#
|
|
# - To the host: new connections from ramiel to sshd alone (22, the jump from away),
|
|
# then replies.
|
|
# - Through the host: new connections from ramiel to Caddy's 443 alone (172.30.80.2 on
|
|
# edge, where Docker has sent the tunnel address's 443 by then), then replies;
|
|
# nothing to the home network, the other containers or anywhere else.
|
|
# - Towards ramiel: replies alone.
|
|
#
|
|
# IPv4 alone: the tunnel carries no IPv6 (D8).
|
|
|
|
# Made and deleted first, so loading this again replaces it whole.
|
|
table inet halkyon_tunnel {}
|
|
delete table inet halkyon_tunnel
|
|
|
|
table inet halkyon_tunnel {
|
|
chain input {
|
|
type filter hook input priority filter - 1; policy accept;
|
|
iifname "wg-halkyon" ct state established,related accept
|
|
iifname "wg-halkyon" ip saddr 10.61.97.1 tcp dport 22 accept
|
|
iifname "wg-halkyon" drop
|
|
}
|
|
|
|
chain forward {
|
|
type filter hook forward priority filter - 1; policy accept;
|
|
iifname "wg-halkyon" ct state established,related accept
|
|
iifname "wg-halkyon" ip saddr 10.61.97.1 ip daddr 172.30.80.2 tcp dport 443 accept
|
|
iifname "wg-halkyon" drop
|
|
oifname "wg-halkyon" ct state established,related accept
|
|
oifname "wg-halkyon" drop
|
|
}
|
|
|
|
chain output {
|
|
type filter hook output priority filter - 1; policy accept;
|
|
oifname "wg-halkyon" ct state established,related accept
|
|
oifname "wg-halkyon" drop
|
|
}
|
|
}
|