From 5cd290eeba08233bb462d8340c3ffdb7bdeae84f Mon Sep 17 00:00:00 2001 From: heather Date: Sat, 26 Sep 2026 23:36:33 +0000 Subject: [PATCH] heather: allow AstrNet host ingress, keep transit blocked --- hosts/heather/astrnet.nix | 25 ++++++++----------------- 1 file changed, 8 insertions(+), 17 deletions(-) diff --git a/hosts/heather/astrnet.nix b/hosts/heather/astrnet.nix index a1e1fbe..60f1070 100644 --- a/hosts/heather/astrnet.nix +++ b/hosts/heather/astrnet.nix @@ -47,13 +47,13 @@ in { }; }; - # Heather's public firewall is disabled (the cloud SG is the WAN barrier). - # Explicitly restrict traffic FROM AstrNet before normal Docker/host rules: - # BGP from the two expected neighbors, bounded ICMP to our mesh/transit - # addresses only; no service exposure or transit. - # Existing outbound sessions may receive established replies. + # Explicit owner decision: allow all AstrNet members to access Heather's + # host services over either WG leg. This does NOT open additional WAN ports, + # enable forwarding from AstrNet, or route public traffic through the mesh. + # WireGuard peers use allowedIPs 0/0 as an ACL, so do not rely on a packet's + # source address to identify a particular AstrNet client here. systemd.services.astrnet-guard = { - description = "Restrict AstrNet tunnel ingress"; + description = "Allow AstrNet host ingress; block AstrNet transit"; wantedBy = [ "multi-user.target" ]; requiredBy = [ "wireguard-wg-mic-der.service" "wireguard-wg-mic-bd8.service" ]; before = [ "wireguard-wg-mic-der.service" "wireguard-wg-mic-bd8.service" ]; @@ -65,17 +65,8 @@ in { table inet astrnet_guard { chain input { type filter hook input priority -150; policy accept; - iifname { "wg-mic-der", "wg-mic-bd8" } ct state established,related accept - iifname "wg-mic-der" ip saddr 10.99.0.153 tcp dport 179 accept - iifname "wg-mic-bd8" ip saddr 10.99.0.157 tcp dport 179 accept - iifname "wg-mic-der" ip6 saddr fd53:4023:2326:99::99 tcp dport 179 accept - iifname "wg-mic-bd8" ip6 saddr fd53:4023:2326:99::9d tcp dport 179 accept - # Echo requests only from AstrNet sources, to THIS host's addresses. - iifname "wg-mic-der" ip saddr { 10.0.0.0/24, 10.99.0.0/22 } ip daddr { 10.0.0.9, 10.99.0.154 } icmp type echo-request accept - iifname "wg-mic-bd8" ip saddr { 10.0.0.0/24, 10.99.0.0/22 } ip daddr { 10.0.0.9, 10.99.0.158 } icmp type echo-request accept - iifname "wg-mic-der" ip6 saddr { 2a05:f480:2400:1cf7::/64, fd53:4023:2326::/48 } ip6 daddr { 2a05:f480:2400:1cf7::9, fd53:4023:2326:99::9a, fe80::2 } icmpv6 type echo-request accept - iifname "wg-mic-bd8" ip6 saddr { 2a05:f480:2400:1cf7::/64, fd53:4023:2326::/48 } ip6 daddr { 2a05:f480:2400:1cf7::9, fd53:4023:2326:99::9e, fe80::2 } icmpv6 type echo-request accept - iifname { "wg-mic-der", "wg-mic-bd8" } drop + # Full inbound access from AstrNet to Heather, IPv4 and IPv6. + iifname { "wg-mic-der", "wg-mic-bd8" } accept } chain forward { type filter hook forward priority -150; policy accept;