admin
a34aac64d0
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6
38 lines
1.7 KiB
Plaintext
38 lines
1.7 KiB
Plaintext
#!/usr/sbin/nft -f
|
|
# felhom OOB belt — STATIC table (TASK H1). Installed by host-install; loaded on boot by
|
|
# felhom-oob-nft.service. The agent mutates ONLY the two SETS (@operator_ips, @ssh_port) via the
|
|
# narrow FELHOM_OOB sudoers — it NEVER touches the rules [trap 4], so the enforcement semantics are
|
|
# fixed here and cannot be changed by the agent.
|
|
#
|
|
# Enforcement (scoped to iifname "wg-felhom" — the offsite tunnel — so :22 and every other interface
|
|
# are UNTOUCHED [SF-3/OF-5]):
|
|
# - ESTABLISHED,RELATED replies always pass (covers the PBS path + reply traffic; PMTU-safe).
|
|
# - felhom-sshd's port is reachable from the operator /32 (in @operator_ips) over the tunnel ONLY.
|
|
# - any other tunnel source to that port is DROPPED at the host (defense-in-depth vs the endpoint).
|
|
# - the port is unreachable OFF the tunnel entirely.
|
|
# Empty sets (before the agent's first sync) = the port rules match nothing = no enforcement yet
|
|
# (felhom-sshd is not started until the agent renders its config either). priority -5 sits just above
|
|
# the default; policy accept so this table only ever ADDS drops for the felhom-sshd port.
|
|
#
|
|
# Idempotent load: create-then-delete-then-define (a re-run/boot yields a clean table with EMPTY sets;
|
|
# the agent refills them within one tick).
|
|
|
|
table inet felhom_oob
|
|
delete table inet felhom_oob
|
|
|
|
table inet felhom_oob {
|
|
set operator_ips {
|
|
type ipv4_addr
|
|
}
|
|
set ssh_port {
|
|
type inet_service
|
|
}
|
|
chain input {
|
|
type filter hook input priority -5; policy accept;
|
|
ct state established,related accept
|
|
iifname "wg-felhom" tcp dport @ssh_port ip saddr @operator_ips accept
|
|
iifname "wg-felhom" tcp dport @ssh_port drop
|
|
tcp dport @ssh_port iifname != "wg-felhom" drop
|
|
}
|
|
}
|