next ai changes

host/rules.v4.template

@@ -22,14 +22,18 @@
 -A INPUT -i ${PUBIF} -p udp --dport 51820 -j ACCEPT
 -A INPUT -i ${PUBIF} -p udp --dport 1194 -j ACCEPT
 
-# OpenVPN clients: DNS to Unbound only (no SSH, no mgmt from clients)
+# OpenVPN clients: DNS to Technitium only (no SSH, no mgmt from clients)
 -A INPUT -i tun0 -d 172.31.8.1/32 -p udp --dport 53 -j ACCEPT
 -A INPUT -i tun0 -d 172.31.8.1/32 -p tcp --dport 53 -j ACCEPT
 
-# Site tunnels: allow DNS in case site hosts want to use Unbound
+# Site tunnels: allow DNS in case site hosts want to use Technitium
 -A INPUT -i wg0 -p udp --dport 53 -j ACCEPT
 -A INPUT -i wg0 -p tcp --dport 53 -j ACCEPT
 
+# Technitium web console — VPN clients and site tunnels only, never public
+-A INPUT -i tun0 -p tcp --dport 5380 -j ACCEPT
+-A INPUT -i wg0 -p tcp --dport 5380 -j ACCEPT
+
 # ── FORWARD (routed, no NAT — DCs see real client IPs) ────────────────
 -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
 -A FORWARD -m conntrack --ctstate INVALID -j DROP

host/rules.v6.template

@@ -0,0 +1,27 @@
+# ip6tables ruleset for the RackNerd VPN hub.
+# The VPS has a public IPv6 address; all tunnel/VPN traffic is IPv4-only,
+# so v6 is locked down to SSH + the same public services as v4.
+# ${PUBIF} is substituted by host/setup.sh / Ansible.
+# Installed to /etc/iptables/rules.v6 (iptables-persistent).
+
+*filter
+:INPUT DROP [0:0]
+:FORWARD DROP [0:0]
+:OUTPUT ACCEPT [0:0]
+
+-A INPUT -i lo -j ACCEPT
+-A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
+-A INPUT -m conntrack --ctstate INVALID -j DROP
+
+# ICMPv6 is mandatory (NDP, PMTUD) — dropping it breaks IPv6 entirely
+-A INPUT -p ipv6-icmp -j ACCEPT
+# DHCPv6 replies from link-local, if the provider uses it
+-A INPUT -s fe80::/10 -p udp --dport 546 -j ACCEPT
+
+# Same public exposure as v4: SSH, WireGuard, OpenVPN — nothing else.
+# Technitium :53/:5380 and RADIUS stay unreachable over v6.
+-A INPUT -i ${PUBIF} -p tcp --dport 22 -m conntrack --ctstate NEW -j ACCEPT
+-A INPUT -i ${PUBIF} -p udp --dport 51820 -j ACCEPT
+-A INPUT -i ${PUBIF} -p udp --dport 1194 -j ACCEPT
+
+COMMIT

host/setup.sh

@@ -18,8 +18,18 @@ echo "==> sysctl (ip_forward)"
 install -m 0644 99-vpnhub-sysctl.conf /etc/sysctl.d/99-vpnhub.conf
 sysctl --system >/dev/null
 
+echo "==> Freeing port 53 (systemd-resolved stub listener) for Technitium"
+mkdir -p /etc/systemd/resolved.conf.d
+printf '[Resolve]\nDNSStubListener=no\n' > /etc/systemd/resolved.conf.d/99-vpnhub.conf
+# resolv.conf must stop pointing at the (now dead) 127.0.0.53 stub
+if [ -e /run/systemd/resolve/resolv.conf ]; then
+  ln -sf /run/systemd/resolve/resolv.conf /etc/resolv.conf
+fi
+systemctl try-restart systemd-resolved || true
+
 echo "==> Firewall (WARNING: INPUT policy DROP — port 22 stays open)"
 sed "s/\${PUBIF}/${PUBIF}/g" rules.v4.template > /etc/iptables/rules.v4
+sed "s/\${PUBIF}/${PUBIF}/g" rules.v6.template > /etc/iptables/rules.v6
 netfilter-persistent reload
 # reload flushed Docker's chains; put them back if Docker is running
 if systemctl is-active --quiet docker; then