mikl/nix-config
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(heather): restore inbound Docker access with WAN return routing

Browse source
This commit is contained in:
mikl 2026-09-29 01:49:11 +03:00
commit db25302c85
1 changed files with 16 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

17
hosts/heather/astrnet.nix
View file

@ -33,6 +33,10 @@ let
# to reach their own endpoints through the mesh default).
wanTable = "100";
wgMark = "0x4d49";
# Mark only WAN connections forwarded to published Docker ports. Their
# replies originate from a container, so the `from wanIp4` rule cannot
# select the WAN until after routing/NAT. Restore wgMark on the reply.
dockerInboundMark = "0x4d4a";
wanRules =
[ { fam = "-4"; sel = "fwmark ${wgMark}"; }
{ fam = "-4"; sel = "from ${wanIp4}"; }
@ -93,6 +97,12 @@ in {
nft list table inet astrnet_guard >/dev/null 2>&1 && nft delete table inet astrnet_guard
nft -f - <<'RULES'
table inet astrnet_guard {
chain prerouting {
type filter hook prerouting priority -150; policy accept;
# Reply packets from Docker inherit the connection mark before the
# routing decision; only public-WAN inbound connections get this mark.
iifname "br-*" ct mark ${dockerInboundMark} meta mark set ${wgMark}
}
chain input {
type filter hook input priority -150; policy accept;
# Full inbound access from AstrNet to Heather, IPv4 and IPv6.
@ -102,7 +112,12 @@ in {
}
chain forward {
type filter hook forward priority -150; policy accept;
# Only replies to Docker-initiated connections, never new mesh transit.
# A public connection DNATed by Docker must return via the public WAN,
# not the AstrNet default. This does not affect Docker-originated egress.
iifname "enp7s0" oifname "br-*" ct status dnat ct mark set ${dockerInboundMark}
# Allow mesh peers to reach only Docker-published ports (DNAT), not
# arbitrary forwarded destinations. Host services use the input chain.
iifname { "wg-mic-der", "wg-mic-bd8" } oifname "br-*" ct status dnat accept
iifname { "wg-mic-der", "wg-mic-bd8" } ct state established,related accept
iifname { "wg-mic-der", "wg-mic-bd8" } drop
}