forked from heavy-duty/box
claude-hdb
edf8309f99
Reproduced the drill's E failure on a live stack (Incus 6.0.4, container box, same setup-host/box-firewall): tcpdump on boxnet shows the SYN leaving masqueraded as the gateway and the box answering SYN/ACK instantly — which then dies at the host's input hook. The inet-box input chain dropped ALL boxnet input except DNS/DHCP, stateless: the reply to the very connection the door opened. UFW hosts never had this hole (before.rules accepts RELATED,ESTABLISHED); the nft fallback now matches that semantics with a ct state established,related accept ahead of the drop. Boxes still cannot INITIATE toward the host — a box-originated SYN is a NEW flow, which is what the drop is for. Also rebuild the chains on every run (add chain + flush + re-add) instead of skip-if-present: the existence guard pinned every host to the rule set of the release that first ran there, so an upgraded rule never landed. Verified end-to-end on the repro stack: curl 127.0.0.1:18091 → HTTP 200; box→host initiation still times out; DNS carve-out intact; non-exposed port still dropped; --remove kills the door; re-expose returns 200. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| box-firewall.service | ||
| box-firewall.sh | ||
| migrate-host.sh | ||
| setup-host.sh | ||
| teardown-host.sh | ||