23 lines
1.6 KiB
Markdown
23 lines
1.6 KiB
Markdown
# ep0 — the line-speed test server (R-1247)
|
|
|
|
Operator ruling 2026-10-24 07:26: a box's agent runs a weekly 10-second upload test to an iperf3 server on ep0,
|
|
**inside the WireGuard tunnel only**. Installed 2026-10-24 (evidence `documentation/audits/line-test-2026-10-24/`).
|
|
|
|
- Package: Debian `iperf3` (3.18-2+deb13u2 at install; it was already present since 2026-07-03). Debian's own
|
|
`iperf3.service` stays **disabled**.
|
|
- Unit: `felhom-iperf3.service` (this folder) → `/etc/systemd/system/`, `systemctl enable --now felhom-iperf3`.
|
|
Listens on `10.77.0.1:5201` only, as a DynamicUser, with memory/task/CPU caps.
|
|
- Firewall: one line in `/etc/nftables.conf`'s `input` chain, after the PBS line, and the same rule live:
|
|
|
|
tcp dport 5201 iifname "wg0" ip saddr 10.77.0.0/24 accept
|
|
|
|
Live: `nft add rule inet filter input position <handle of the 8007 rule> tcp dport 5201 iifname "wg0" ip saddr 10.77.0.0/24 accept`.
|
|
- Proof that it never answers on the internet: a TCP connect from any public address to `167.233.158.164:5201` gets
|
|
no answer (with `:22` as the control); from a box host through the tunnel it answers.
|
|
- Known server issues of 3.18 (no Debian advisory, „minor"): CVE-2026-71217 (resource exhaustion by oversized
|
|
parameters) and CVE-2026-102253 (a UDP worker spins). Bounded by: tunnel peers only, TCP only, the unit's caps, a daily
|
|
restart. Re-check when Debian ships 3.22.
|
|
- Remove: `systemctl disable --now felhom-iperf3; rm /etc/systemd/system/felhom-iperf3.service`; delete the nft line
|
|
(live `nft delete rule inet filter input handle <n>`, and in the file). The backup of the file before the change is
|
|
`/etc/nftables.conf.bak-20261024-iperf3`.
|