AtlasHorizon/racknerd
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

next ai changes

Browse Source
This commit is contained in:
nick committed 2026-07-15 18:50:19 -07:00
1 parent 911b1f8c5d
commit b745376a65
23 files changed
+705 -155
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

host/rules.v4.template
+6 -2
View File
@@ -22,14 +22,18 @@
-A INPUT -i ${PUBIF} -p udp --dport 51820 -j ACCEPT
-A INPUT -i ${PUBIF} -p udp --dport 1194 -j ACCEPT
# OpenVPN clients: DNS to Unbound only (no SSH, no mgmt from clients)
# OpenVPN clients: DNS to Technitium only (no SSH, no mgmt from clients)
-A INPUT -i tun0 -d 172.31.8.1/32 -p udp --dport 53 -j ACCEPT
-A INPUT -i tun0 -d 172.31.8.1/32 -p tcp --dport 53 -j ACCEPT
# Site tunnels: allow DNS in case site hosts want to use Unbound
# Site tunnels: allow DNS in case site hosts want to use Technitium
-A INPUT -i wg0 -p udp --dport 53 -j ACCEPT
-A INPUT -i wg0 -p tcp --dport 53 -j ACCEPT
# Technitium web console — VPN clients and site tunnels only, never public
-A INPUT -i tun0 -p tcp --dport 5380 -j ACCEPT
-A INPUT -i wg0 -p tcp --dport 5380 -j ACCEPT
# ── FORWARD (routed, no NAT — DCs see real client IPs) ────────────────
-A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
-A FORWARD -m conntrack --ctstate INVALID -j DROP