claude generated first pass

host/rules.v4.template

@@ -0,0 +1,54 @@
+# iptables ruleset for the RackNerd VPN hub.
+# ${PUBIF} is substituted by host/setup.sh with the detected public interface.
+# Installed to /etc/iptables/rules.v4 (iptables-persistent).
+#
+# NOTE: after any manual `netfilter-persistent reload`, run
+# `systemctl restart docker` — the reload flushes Docker's chains.
+
+*filter
+:INPUT DROP [0:0]
+:FORWARD DROP [0:0]
+:OUTPUT ACCEPT [0:0]
+:DOCKER-USER - [0:0]
+
+# ── INPUT ──────────────────────────────────────────────────────────────
+-A INPUT -i lo -j ACCEPT
+-A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
+-A INPUT -m conntrack --ctstate INVALID -j DROP
+-A INPUT -p icmp -j ACCEPT
+
+# Public interface: SSH (key-only!), WireGuard, OpenVPN — nothing else.
+-A INPUT -i ${PUBIF} -p tcp --dport 22 -m conntrack --ctstate NEW -j ACCEPT
+-A INPUT -i ${PUBIF} -p udp --dport 51820 -j ACCEPT
+-A INPUT -i ${PUBIF} -p udp --dport 1194 -j ACCEPT
+
+# OpenVPN clients: DNS to Unbound only (no SSH, no mgmt from clients)
+-A INPUT -i tun0 -d 172.31.8.1/32 -p udp --dport 53 -j ACCEPT
+-A INPUT -i tun0 -d 172.31.8.1/32 -p tcp --dport 53 -j ACCEPT
+
+# Site tunnels: allow DNS in case site hosts want to use Unbound
+-A INPUT -i wg0 -p udp --dport 53 -j ACCEPT
+-A INPUT -i wg0 -p tcp --dport 53 -j ACCEPT
+
+# ── FORWARD (routed, no NAT — DCs see real client IPs) ────────────────
+-A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
+-A FORWARD -m conntrack --ctstate INVALID -j DROP
+
+# Roaming clients -> both sites + WG transfer net
+-A FORWARD -i tun0 -o wg0 -s 172.31.8.0/24 -d 192.168.20.0/24 -j ACCEPT
+-A FORWARD -i tun0 -o wg0 -s 172.31.8.0/24 -d 192.168.7.0/24 -j ACCEPT
+-A FORWARD -i tun0 -o wg0 -s 172.31.8.0/24 -d 172.31.255.0/24 -j ACCEPT
+
+# Site -> client NEW connections (e.g. RDP/RSAT from a DC to a roaming
+# laptop). Off by default; uncomment if you need it.
+#-A FORWARD -i wg0 -o tun0 -d 172.31.8.0/24 -j ACCEPT
+
+COMMIT
+
+# ── Fallback per project brief ─────────────────────────────────────────
+# If site-side return routing for 172.31.8.0/24 becomes a pain, NAT the
+# clients behind the wg0 address instead (DCs then see 172.31.255.1):
+#*nat
+#:POSTROUTING ACCEPT [0:0]
+#-A POSTROUTING -s 172.31.8.0/24 -o wg0 -j MASQUERADE
+#COMMIT