ep0 — the line-speed test server (R-1247)

Operator ruling 2026-10-24 07:26: a box's agent runs a weekly 10-second upload test to an iperf3 server on ep0, inside the WireGuard tunnel only. Installed 2026-10-24 (evidence documentation/audits/line-test-2026-10-24/).

Package: Debian iperf3 (3.18-2+deb13u2 at install; it was already present since 2026-07-03). Debian's own iperf3.service stays disabled.
Unit: felhom-iperf3.service (this folder) → /etc/systemd/system/, systemctl enable --now felhom-iperf3. Listens on 10.77.0.1:5201 only, as a DynamicUser, with memory/task/CPU caps.
Firewall: one line in /etc/nftables.conf's input chain, after the PBS line, and the same rule live:
```
tcp dport 5201 iifname "wg0" ip saddr 10.77.0.0/24 accept
```
Live: nft add rule inet filter input position <handle of the 8007 rule> tcp dport 5201 iifname "wg0" ip saddr 10.77.0.0/24 accept.
Proof that it never answers on the internet: a TCP connect from any public address to 167.233.158.164:5201 gets no answer (with :22 as the control); from a box host through the tunnel it answers.
Known server issues of 3.18 (no Debian advisory, „minor"): CVE-2026-71217 (resource exhaustion by oversized parameters) and CVE-2026-102253 (a UDP worker spins). Bounded by: tunnel peers only, TCP only, the unit's caps, a daily restart. Re-check when Debian ships 3.22.
Remove: systemctl disable --now felhom-iperf3; rm /etc/systemd/system/felhom-iperf3.service; delete the nft line (live nft delete rule inet filter input handle <n>, and in the file). The backup of the file before the change is /etc/nftables.conf.bak-20261024-iperf3.