mikl/nix-config
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

heather: allow AstrNet host ingress, keep transit blocked

Browse source
This commit is contained in:
heather 2026-09-26 23:36:33 +00:00
commit 5cd290eeba
1 changed files with 8 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

25
hosts/heather/astrnet.nix
View file

@ -47,13 +47,13 @@ in {
}; };
}; };
# Heather's public firewall is disabled (the cloud SG is the WAN barrier). # Explicit owner decision: allow all AstrNet members to access Heather's
# Explicitly restrict traffic FROM AstrNet before normal Docker/host rules: # host services over either WG leg. This does NOT open additional WAN ports,
# BGP from the two expected neighbors, bounded ICMP to our mesh/transit # enable forwarding from AstrNet, or route public traffic through the mesh.
# addresses only; no service exposure or transit. # WireGuard peers use allowedIPs 0/0 as an ACL, so do not rely on a packet's
# Existing outbound sessions may receive established replies. # source address to identify a particular AstrNet client here.
systemd.services.astrnet-guard = { systemd.services.astrnet-guard = {
description = "Restrict AstrNet tunnel ingress"; description = "Allow AstrNet host ingress; block AstrNet transit";
wantedBy = [ "multi-user.target" ]; wantedBy = [ "multi-user.target" ];
requiredBy = [ "wireguard-wg-mic-der.service" "wireguard-wg-mic-bd8.service" ]; requiredBy = [ "wireguard-wg-mic-der.service" "wireguard-wg-mic-bd8.service" ];
before = [ "wireguard-wg-mic-der.service" "wireguard-wg-mic-bd8.service" ]; before = [ "wireguard-wg-mic-der.service" "wireguard-wg-mic-bd8.service" ];
@ -65,17 +65,8 @@ in {
table inet astrnet_guard { table inet astrnet_guard {
chain input { chain input {
type filter hook input priority -150; policy accept; type filter hook input priority -150; policy accept;
iifname { "wg-mic-der", "wg-mic-bd8" } ct state established,related accept # Full inbound access from AstrNet to Heather, IPv4 and IPv6.
iifname "wg-mic-der" ip saddr 10.99.0.153 tcp dport 179 accept iifname { "wg-mic-der", "wg-mic-bd8" } accept
iifname "wg-mic-bd8" ip saddr 10.99.0.157 tcp dport 179 accept
iifname "wg-mic-der" ip6 saddr fd53:4023:2326:99::99 tcp dport 179 accept
iifname "wg-mic-bd8" ip6 saddr fd53:4023:2326:99::9d tcp dport 179 accept
# Echo requests only from AstrNet sources, to THIS host's addresses.
iifname "wg-mic-der" ip saddr { 10.0.0.0/24, 10.99.0.0/22 } ip daddr { 10.0.0.9, 10.99.0.154 } icmp type echo-request accept
iifname "wg-mic-bd8" ip saddr { 10.0.0.0/24, 10.99.0.0/22 } ip daddr { 10.0.0.9, 10.99.0.158 } icmp type echo-request accept
iifname "wg-mic-der" ip6 saddr { 2a05:f480:2400:1cf7::/64, fd53:4023:2326::/48 } ip6 daddr { 2a05:f480:2400:1cf7::9, fd53:4023:2326:99::9a, fe80::2 } icmpv6 type echo-request accept
iifname "wg-mic-bd8" ip6 saddr { 2a05:f480:2400:1cf7::/64, fd53:4023:2326::/48 } ip6 daddr { 2a05:f480:2400:1cf7::9, fd53:4023:2326:99::9e, fe80::2 } icmpv6 type echo-request accept
iifname { "wg-mic-der", "wg-mic-bd8" } drop
} }
chain forward { chain forward {
type filter hook forward priority -150; policy accept; type filter hook forward priority -150; policy accept;