# ep0 — the line-speed test server (R-1247)

Operator ruling 2026-10-24 07:26: a box's agent runs a weekly 10-second upload test to an iperf3 server on ep0,
**inside the WireGuard tunnel only**. Installed 2026-10-24 (evidence `documentation/audits/line-test-2026-10-24/`).

- Package: Debian `iperf3` (3.18-2+deb13u2 at install; it was already present since 2026-07-03). Debian's own
  `iperf3.service` stays **disabled**.
- Unit: `felhom-iperf3.service` (this folder) → `/etc/systemd/system/`, `systemctl enable --now felhom-iperf3`.
  Listens on `10.77.0.1:5201` only, as a DynamicUser, with memory/task/CPU caps.
- Firewall: one line in `/etc/nftables.conf`'s `input` chain, after the PBS line, and the same rule live:

      tcp dport 5201 iifname "wg0" ip saddr 10.77.0.0/24 accept

  Live: `nft add rule inet filter input position <handle of the 8007 rule> tcp dport 5201 iifname "wg0" ip saddr 10.77.0.0/24 accept`.
- Proof that it never answers on the internet: a TCP connect from any public address to `167.233.158.164:5201` gets
  no answer (with `:22` as the control); from a box host through the tunnel it answers.
- Known server issues of 3.18 (no Debian advisory, „minor"): CVE-2026-71217 (resource exhaustion by oversized
  parameters) and CVE-2026-102253 (a UDP worker spins). Bounded by: tunnel peers only, TCP only, the unit's caps, a daily
  restart. Re-check when Debian ships 3.22.
- Remove: `systemctl disable --now felhom-iperf3; rm /etc/systemd/system/felhom-iperf3.service`; delete the nft line
  (live `nft delete rule inet filter input handle <n>`, and in the file). The backup of the file before the change is
  `/etc/nftables.conf.bak-20261024-iperf3`.