The host says what filters the machine, with owners, and keeps the found firewall retired on every converged apply (hq ADR 0168)
Every table and chain that refuses traffic is reported with whose it is: the mesh's, the found firewall's, the container runtime's own, a ban, or other — the runtime's user chain is other, which is where both predecessors kept their rules, in the legacy filter on one machine and invisible to the mesh. Adoption's threshold does not move; a converged machine's report grows by its filters and its found firewall's state. Convergence is a state the host keeps: a found firewall enabled again is retired again and said; a reconcile that finds it inactive records that it was found so, never that the mesh did it; a step skipped after a failed apply is said. A retirement the mesh began and did not finish is finished. Fixtures are rulesets captured from three machines of the first mesh.
This commit is contained in:
+327
@@ -0,0 +1,327 @@
|
||||
table ip mangle {
|
||||
chain FORWARD {
|
||||
type filter hook forward priority mangle; policy accept;
|
||||
}
|
||||
}
|
||||
# Warning: table ip nat is managed by iptables-nft, do not touch!
|
||||
table ip nat {
|
||||
chain PREROUTING {
|
||||
type nat hook prerouting priority dstnat; policy accept;
|
||||
xt match "addrtype" counter packets 12072 bytes 4564241 jump DOCKER
|
||||
}
|
||||
|
||||
chain OUTPUT {
|
||||
type nat hook output priority dstnat; policy accept;
|
||||
ip daddr != 127.0.0.0/8 xt match "addrtype" counter packets 1854 bytes 111240 jump DOCKER
|
||||
}
|
||||
|
||||
chain POSTROUTING {
|
||||
type nat hook postrouting priority srcnat; policy accept;
|
||||
ip saddr 172.17.0.0/16 oifname != "docker0" counter packets 903 bytes 61577 xt target "MASQUERADE"
|
||||
ip saddr 172.21.0.0/16 oifname != "br-86a5d6b30e2b" counter packets 344 bytes 27744 xt target "MASQUERADE"
|
||||
ip saddr 172.25.0.0/16 oifname != "br-61495e14a004" counter packets 374 bytes 33016 xt target "MASQUERADE"
|
||||
ip saddr 172.30.0.0/16 oifname != "br-5107796ee9b4" counter packets 352 bytes 28224 xt target "MASQUERADE"
|
||||
ip saddr 172.18.0.0/16 oifname != "br-cfd337ac4e58" counter packets 339 bytes 27444 xt target "MASQUERADE"
|
||||
ip saddr 172.19.0.0/16 oifname != "br-8f0c6ee01425" counter packets 351 bytes 28164 xt target "MASQUERADE"
|
||||
ip saddr 172.22.0.0/16 oifname != "br-75ac3c36e87f" counter packets 333 bytes 27084 xt target "MASQUERADE"
|
||||
ip saddr 172.20.0.0/16 oifname != "br-0529801521bc" counter packets 343 bytes 27404 xt target "MASQUERADE"
|
||||
}
|
||||
|
||||
chain DOCKER {
|
||||
iifname != "br-61495e14a004" tcp dport 5680 counter packets 2 bytes 120 xt target "DNAT"
|
||||
ip daddr 127.0.0.1 iifname != "br-61495e14a004" tcp dport 15673 counter packets 0 bytes 0 xt target "DNAT"
|
||||
ip daddr 127.0.0.1 iifname != "docker0" tcp dport 55432 counter packets 0 bytes 0 xt target "DNAT"
|
||||
}
|
||||
}
|
||||
# Warning: table ip filter is managed by iptables-nft, do not touch!
|
||||
table ip filter {
|
||||
chain DOCKER-FORWARD {
|
||||
counter packets 702328 bytes 1801910999 jump DOCKER-CT
|
||||
counter packets 337315 bytes 23928864 jump DOCKER-INTERNAL
|
||||
counter packets 337315 bytes 23928864 jump DOCKER-BRIDGE
|
||||
iifname "br-75ac3c36e87f" counter packets 0 bytes 0 accept
|
||||
iifname "br-86a5d6b30e2b" counter packets 0 bytes 0 accept
|
||||
iifname "br-8f0c6ee01425" counter packets 0 bytes 0 accept
|
||||
iifname "br-cfd337ac4e58" counter packets 0 bytes 0 accept
|
||||
iifname "br-0529801521bc" counter packets 0 bytes 0 accept
|
||||
iifname "br-5107796ee9b4" counter packets 0 bytes 0 accept
|
||||
iifname "br-61495e14a004" counter packets 0 bytes 0 accept
|
||||
iifname "docker0" counter packets 337315 bytes 23928864 accept
|
||||
}
|
||||
|
||||
chain FORWARD {
|
||||
type filter hook forward priority filter; policy drop;
|
||||
counter packets 702328 bytes 1801910999 jump DOCKER-USER
|
||||
counter packets 702328 bytes 1801910999 jump DOCKER-FORWARD
|
||||
}
|
||||
|
||||
chain DOCKER-USER {
|
||||
ip protocol tcp counter packets 702510 bytes 1801965868 jump f2b-sshd
|
||||
oifname "incusbr0" counter packets 0 bytes 0 accept
|
||||
iifname "incusbr0" counter packets 0 bytes 0 accept
|
||||
}
|
||||
|
||||
chain f2b-sshd {
|
||||
counter packets 10423854 bytes 13891318049 return
|
||||
}
|
||||
|
||||
chain INPUT {
|
||||
type filter hook input priority filter; policy accept;
|
||||
ip protocol tcp counter packets 9721344 bytes 12089352181 jump f2b-sshd
|
||||
}
|
||||
|
||||
chain DOCKER {
|
||||
ip daddr 172.17.0.2 iifname != "docker0" oifname "docker0" tcp dport 5432 counter packets 0 bytes 0 accept
|
||||
ip daddr 172.25.0.2 iifname != "br-61495e14a004" oifname "br-61495e14a004" tcp dport 15672 counter packets 0 bytes 0 accept
|
||||
ip daddr 172.25.0.2 iifname != "br-61495e14a004" oifname "br-61495e14a004" tcp dport 5672 counter packets 0 bytes 0 accept
|
||||
iifname != "br-75ac3c36e87f" oifname "br-75ac3c36e87f" counter packets 0 bytes 0 drop
|
||||
iifname != "br-86a5d6b30e2b" oifname "br-86a5d6b30e2b" counter packets 0 bytes 0 drop
|
||||
iifname != "br-8f0c6ee01425" oifname "br-8f0c6ee01425" counter packets 0 bytes 0 drop
|
||||
iifname != "br-cfd337ac4e58" oifname "br-cfd337ac4e58" counter packets 0 bytes 0 drop
|
||||
iifname != "br-0529801521bc" oifname "br-0529801521bc" counter packets 0 bytes 0 drop
|
||||
iifname != "br-5107796ee9b4" oifname "br-5107796ee9b4" counter packets 0 bytes 0 drop
|
||||
iifname != "br-61495e14a004" oifname "br-61495e14a004" counter packets 0 bytes 0 drop
|
||||
iifname != "docker0" oifname "docker0" counter packets 0 bytes 0 drop
|
||||
}
|
||||
|
||||
chain DOCKER-BRIDGE {
|
||||
oifname "br-75ac3c36e87f" counter packets 0 bytes 0 jump DOCKER
|
||||
oifname "br-86a5d6b30e2b" counter packets 0 bytes 0 jump DOCKER
|
||||
oifname "br-8f0c6ee01425" counter packets 0 bytes 0 jump DOCKER
|
||||
oifname "br-cfd337ac4e58" counter packets 0 bytes 0 jump DOCKER
|
||||
oifname "br-0529801521bc" counter packets 0 bytes 0 jump DOCKER
|
||||
oifname "br-5107796ee9b4" counter packets 0 bytes 0 jump DOCKER
|
||||
oifname "br-61495e14a004" counter packets 0 bytes 0 jump DOCKER
|
||||
oifname "docker0" counter packets 0 bytes 0 jump DOCKER
|
||||
}
|
||||
|
||||
chain DOCKER-CT {
|
||||
oifname "br-75ac3c36e87f" xt match "conntrack" counter packets 0 bytes 0 accept
|
||||
oifname "br-86a5d6b30e2b" xt match "conntrack" counter packets 0 bytes 0 accept
|
||||
oifname "br-8f0c6ee01425" xt match "conntrack" counter packets 0 bytes 0 accept
|
||||
oifname "br-cfd337ac4e58" xt match "conntrack" counter packets 0 bytes 0 accept
|
||||
oifname "br-0529801521bc" xt match "conntrack" counter packets 0 bytes 0 accept
|
||||
oifname "br-5107796ee9b4" xt match "conntrack" counter packets 0 bytes 0 accept
|
||||
oifname "br-61495e14a004" xt match "conntrack" counter packets 0 bytes 0 accept
|
||||
oifname "docker0" xt match "conntrack" counter packets 365013 bytes 1777982135 accept
|
||||
}
|
||||
|
||||
chain DOCKER-INTERNAL {
|
||||
}
|
||||
}
|
||||
# Warning: table ip6 nat is managed by iptables-nft, do not touch!
|
||||
table ip6 nat {
|
||||
chain PREROUTING {
|
||||
type nat hook prerouting priority dstnat; policy accept;
|
||||
xt match "addrtype" counter packets 363 bytes 67927 jump DOCKER
|
||||
}
|
||||
|
||||
chain OUTPUT {
|
||||
type nat hook output priority dstnat; policy accept;
|
||||
ip6 daddr != ::1 xt match "addrtype" counter packets 0 bytes 0 jump DOCKER
|
||||
}
|
||||
|
||||
chain DOCKER {
|
||||
}
|
||||
}
|
||||
table ip6 filter {
|
||||
chain DOCKER-FORWARD {
|
||||
counter packets 0 bytes 0 jump DOCKER-CT
|
||||
counter packets 0 bytes 0 jump DOCKER-INTERNAL
|
||||
counter packets 0 bytes 0 jump DOCKER-BRIDGE
|
||||
}
|
||||
|
||||
chain FORWARD {
|
||||
type filter hook forward priority filter; policy accept;
|
||||
counter packets 0 bytes 0 jump DOCKER-USER
|
||||
counter packets 0 bytes 0 jump DOCKER-FORWARD
|
||||
}
|
||||
|
||||
chain DOCKER-USER {
|
||||
}
|
||||
|
||||
chain DOCKER {
|
||||
}
|
||||
|
||||
chain DOCKER-BRIDGE {
|
||||
}
|
||||
|
||||
chain DOCKER-CT {
|
||||
}
|
||||
|
||||
chain DOCKER-INTERNAL {
|
||||
}
|
||||
}
|
||||
table ip raw {
|
||||
chain PREROUTING {
|
||||
type filter hook prerouting priority raw; policy accept;
|
||||
ip daddr 172.25.0.2 iifname != "br-61495e14a004" counter packets 0 bytes 0 drop
|
||||
ip daddr 127.0.0.1 iifname != "lo" tcp dport 15673 counter packets 0 bytes 0 drop
|
||||
ip daddr 172.17.0.2 iifname != "docker0" counter packets 0 bytes 0 drop
|
||||
ip daddr 127.0.0.1 iifname != "lo" tcp dport 55432 counter packets 0 bytes 0 drop
|
||||
}
|
||||
}
|
||||
table inet incus {
|
||||
set bridges {
|
||||
type ifname
|
||||
elements = { "incusbr0" }
|
||||
}
|
||||
|
||||
chain pstrt.incusbr0 {
|
||||
type nat hook postrouting priority srcnat; policy accept;
|
||||
ip saddr 10.7.169.0/24 oifname @bridges accept
|
||||
ip saddr 10.7.169.0/24 ip daddr != 10.7.169.0/24 masquerade
|
||||
ip6 saddr fd42:cbc4:e123:f6::/64 oifname @bridges accept
|
||||
ip6 saddr fd42:cbc4:e123:f6::/64 ip6 daddr != fd42:cbc4:e123:f6::/64 masquerade
|
||||
}
|
||||
|
||||
chain fwd.incusbr0 {
|
||||
type filter hook forward priority filter; policy accept;
|
||||
ip version 4 oifname "incusbr0" accept
|
||||
ip version 4 iifname "incusbr0" accept
|
||||
ip6 version 6 oifname "incusbr0" accept
|
||||
ip6 version 6 iifname "incusbr0" accept
|
||||
}
|
||||
|
||||
chain in.incusbr0 {
|
||||
type filter hook input priority filter; policy accept;
|
||||
iifname "incusbr0" tcp dport 53 accept
|
||||
iifname "incusbr0" udp dport 53 accept
|
||||
iifname "incusbr0" icmp type { destination-unreachable, time-exceeded, parameter-problem } accept
|
||||
iifname "incusbr0" udp dport 67 accept
|
||||
iifname "incusbr0" ip protocol udp udp checksum set 0
|
||||
iifname "incusbr0" icmpv6 type { destination-unreachable, packet-too-big, time-exceeded, parameter-problem, nd-router-solicit, nd-neighbor-solicit, nd-neighbor-advert, mld2-listener-report } accept
|
||||
iifname "incusbr0" udp dport 547 accept
|
||||
}
|
||||
|
||||
chain out.incusbr0 {
|
||||
type filter hook output priority filter; policy accept;
|
||||
oifname "incusbr0" tcp sport 53 accept
|
||||
oifname "incusbr0" udp sport 53 accept
|
||||
oifname "incusbr0" icmp type { destination-unreachable, time-exceeded, parameter-problem } accept
|
||||
oifname "incusbr0" udp sport 67 accept
|
||||
oifname "incusbr0" ip protocol udp udp checksum set 0
|
||||
oifname "incusbr0" icmpv6 type { destination-unreachable, packet-too-big, time-exceeded, parameter-problem, echo-request, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert, mld2-listener-report } accept
|
||||
oifname "incusbr0" udp sport 547 accept
|
||||
}
|
||||
}
|
||||
table ip fct_filter {
|
||||
chain OUTPUT {
|
||||
type filter hook output priority filter; policy accept;
|
||||
}
|
||||
|
||||
chain FCT-QUARANTINE-EMS {
|
||||
}
|
||||
|
||||
chain FCT-QUARANTINE-FAZ {
|
||||
}
|
||||
|
||||
chain FORWARD {
|
||||
type filter hook forward priority filter; policy accept;
|
||||
}
|
||||
|
||||
chain FCT-WEBFILTER-QUIC-CHAIN {
|
||||
}
|
||||
|
||||
chain INPUT {
|
||||
type filter hook input priority filter; policy accept;
|
||||
}
|
||||
|
||||
chain FCT-QUARANTINE {
|
||||
}
|
||||
|
||||
chain FCT-DNS-QUIC-FILTER {
|
||||
}
|
||||
|
||||
chain FCT-VPN-CHAIN {
|
||||
}
|
||||
}
|
||||
table ip fct_nat {
|
||||
chain OUTPUT {
|
||||
type nat hook output priority dstnat; policy accept;
|
||||
}
|
||||
|
||||
chain FCT-DNS-UDP-CHAIN-STAGE-2 {
|
||||
}
|
||||
|
||||
chain FCT-DNS-UDP-CHAIN-STAGE-1 {
|
||||
}
|
||||
|
||||
chain FCT-TCP-CHAIN {
|
||||
}
|
||||
|
||||
chain FCT-DNS-DOH-CHAIN-STAGE-1 {
|
||||
}
|
||||
|
||||
chain FCT-WEBFILTER-CHAIN {
|
||||
}
|
||||
|
||||
chain FCT-DNS-DOH-CHAIN-STAGE-2 {
|
||||
}
|
||||
}
|
||||
table ip6 fct_filter {
|
||||
chain FCT-QUARANTINE {
|
||||
}
|
||||
|
||||
chain INPUT {
|
||||
type filter hook input priority filter; policy accept;
|
||||
}
|
||||
|
||||
chain FORWARD {
|
||||
type filter hook forward priority filter; policy accept;
|
||||
}
|
||||
|
||||
chain OUTPUT {
|
||||
type filter hook output priority filter; policy accept;
|
||||
}
|
||||
}
|
||||
table ip fct_mangle {
|
||||
chain PREROUTING {
|
||||
type filter hook prerouting priority mangle; policy accept;
|
||||
}
|
||||
|
||||
chain FCT-UDP-STAGE-1 {
|
||||
}
|
||||
|
||||
chain OUTPUT {
|
||||
type route hook output priority mangle; policy accept;
|
||||
}
|
||||
|
||||
chain FCT-UDP-STAGE-2 {
|
||||
}
|
||||
|
||||
chain FCT-UDP-OUTPUT {
|
||||
}
|
||||
}
|
||||
table inet mesh {
|
||||
chain input {
|
||||
type filter hook input priority filter; policy drop;
|
||||
ct state established,related accept
|
||||
ct state invalid drop
|
||||
iif "lo" accept
|
||||
iifname != { "mesh0", "wlp3s0" } accept
|
||||
icmp type echo-request accept
|
||||
icmpv6 type { echo-request, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert } accept
|
||||
iifname != { "mesh0", "wlp3s0" } udp dport { 53, 67 } accept
|
||||
iifname != { "mesh0", "wlp3s0" } tcp dport 53 accept
|
||||
ip saddr { 10.10.0.1, 10.10.0.2, 10.10.0.3, 10.10.0.4 } tcp dport 22 accept
|
||||
tcp dport 22 accept
|
||||
ip saddr { 10.10.0.1, 10.10.0.2, 10.10.0.3, 10.10.0.4 } tcp dport 53 accept
|
||||
ip saddr { 10.10.0.1, 10.10.0.2, 10.10.0.3, 10.10.0.4 } udp dport 53 accept
|
||||
}
|
||||
|
||||
chain output {
|
||||
type filter hook output priority filter; policy accept;
|
||||
}
|
||||
|
||||
chain forward {
|
||||
type filter hook forward priority filter; policy drop;
|
||||
ct state established,related accept
|
||||
ct state invalid drop
|
||||
iifname != { "mesh0", "wlp3s0" } accept
|
||||
iifname "mesh0" oifname "mesh0" accept
|
||||
ct original proto-dst 22 accept
|
||||
ip saddr { 10.10.0.1, 10.10.0.2, 10.10.0.3, 10.10.0.4 } ct original proto-dst 53 accept
|
||||
ip saddr { 10.10.0.1, 10.10.0.2, 10.10.0.3, 10.10.0.4 } ct original proto-dst 53 accept
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user