Skip to content

Add internet forwarding rules to chain DOCKER-USER instead of chain FORWARD #113

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mtreinik merged 4 commits into from
May 12, 2026
Merged

Add internet forwarding rules to chain DOCKER-USER instead of chain FORWARD #113

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
663133e
Add internet forwarding rules to chain DOCKER-USER instead of chain F…
mtreinik May 11, 2026
012c25b
Log also forwarded DNS requests, their replies and IP addresses added…
mtreinik May 12, 2026
58a1d52
Reduce dnsmasq DNS cache TTL
mtreinik May 12, 2026
6cf738a
Change legacy test name
mtreinik May 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 18 additions & 2 deletions packages/ytl-linux-digabi2-examnet/lib/internet-forwarding.just
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,8 @@ enable net-device-wan net-device-lan error-code: \

just internet-forwarding enable-kernel-ip-forwarding {{error-code}}

just internet-forwarding assert-chain-exists filter DOCKER-USER {{error-code}}

# Remove possible existing iptables rules and recreate allowlist filter chain to ensure idempotency
just internet-forwarding remove-iptables-rules-by-comment "$INTERNET_ALLOWLIST_IPSET_NAME" {{error-code}}
just iptables recreate-chain filter $INTERNET_ALLOWLIST_FILTER_CHAIN {{error-code}}
Expand Down Expand Up @@ -61,14 +63,14 @@ enable net-device-wan net-device-lan error-code: \
--jump DROP

# Allow return traffic
just iptables add-rule filter FORWARD {{error-code}} \
just iptables add-rule filter DOCKER-USER {{error-code}} \
--in-interface "{{net-device-wan}}" --out-interface "{{net-device-lan}}" \
--match comment --comment "$INTERNET_ALLOWLIST_IPSET_NAME" \
--match conntrack --ctstate RELATED,ESTABLISHED \
--jump ACCEPT

# Enforce allowlist for LAN->WAN traffic
just iptables add-rule filter FORWARD {{error-code}} \
just iptables add-rule filter DOCKER-USER {{error-code}} \
--in-interface "{{net-device-lan}}" --out-interface "{{net-device-wan}}" \
--match comment --comment "$INTERNET_ALLOWLIST_IPSET_NAME" \
--jump "$INTERNET_ALLOWLIST_FILTER_CHAIN"
Expand Down Expand Up @@ -103,6 +105,19 @@ disable error-code: \

just log info "Done disabling internet forwarding"

assert-chain-exists table chain error-code:
#!/usr/bin/env bash
set -euo pipefail

just log debug "Checking that iptables chain {{chain}} exists in table {{table}}"

if ! iptables --wait --table {{table}} --list {{chain}} --line-numbers --numeric > /dev/null 2>&1; then
just log error "Required iptables chain {{chain}} does not exist in table {{table}}"
exit {{error-code}}
fi

just log debug "Iptables chain {{chain}} exists in table {{table}}"

configure-logging error-code:
#!/usr/bin/env bash
set -euo pipefail
Expand Down Expand Up @@ -153,6 +168,7 @@ remove-iptables-rules-by-comment comment error-code:
set -euo pipefail

just iptables remove-rules-by-comment nat POSTROUTING {{comment}} {{error-code}}
just iptables remove-rules-by-comment filter DOCKER-USER {{comment}} {{error-code}}
just iptables remove-rules-by-comment filter FORWARD {{comment}} {{error-code}}

flush-and-destroy-ipset ipset-name error-code:
Expand Down
4 changes: 4 additions & 0 deletions packages/ytl-linux-digabi2-examnet/templates/dnsmasq.conf.template
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,3 +47,7 @@ ${ALLOWLISTED_IPSET_CONFIGURATION}
# request stalls (since this is not a router) for however long the client timeout is set to; possibly Infinity
address=/#/0.0.0.0
address=/#/::

# Reduce DNS cache TTLs as Microsoft has very short TTL for the A records of the allowlisted servers
max-cache-ttl=5
max-ttl=5
14 changes: 13 additions & 1 deletion packages/ytl-linux-digabi2-examnet/templates/rsyslog-internet-forwarding.conf.template
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,5 +5,17 @@ if ($msg contains "YTL_ALLOW_NEW-") then {
createDirs="off"
fileCreateMode="0644"
)
stop
}

if ($programname == "dnsmasq" and (
$msg contains " forwarded " or
$msg contains " reply " or
$msg contains " ipset add "
)) then {
action(
type="omfile"
file="$PATH_INTERNET_FORWARDING_LOGS"
createDirs="off"
fileCreateMode="0644"
)
}
2 changes: 1 addition & 1 deletion packages/ytl-linux-digabi2-examnet/test/examnet-legacy.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ import { mkdtemp, writeFile, chmod, readFile, mkdir, unlink, truncate, access }
import { tmpdir } from 'node:os'

const ENV_TEST_MODE = { TEST_MODE: 'test' }
describe('examnet', async () => {
describe('examnet (legacy)', async () => {
let callsLog
let mockBinDir
let mockEtcDir
Expand Down
30 changes: 24 additions & 6 deletions packages/ytl-linux-digabi2-examnet/test/examnet.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -237,6 +237,8 @@ describe('examnet (just port)', () => {
callRm(`${mockEtcDir}/hosts.tmp`),
callIptablesList('nat', 'POSTROUTING'),
callIptablesList('nat', 'POSTROUTING'),
callIptablesList('filter', 'DOCKER-USER'),
callIptablesList('filter', 'DOCKER-USER'),
callIptablesList('filter', 'FORWARD'),
callIptablesList('filter', 'FORWARD'),
callIptablesList('filter', 'YTL_LAN_WAN_IPSET'),
Expand Down Expand Up @@ -271,6 +273,8 @@ describe('examnet (just port)', () => {
callRm(`${mockEtcDir}/hosts.tmp`),
callIptablesList('nat', 'POSTROUTING'),
callIptablesList('nat', 'POSTROUTING'),
callIptablesList('filter', 'DOCKER-USER'),
callIptablesList('filter', 'DOCKER-USER'),
callIptablesList('filter', 'FORWARD'),
callIptablesList('filter', 'FORWARD'),
callIptablesList('filter', 'YTL_LAN_WAN_IPSET'),
Expand Down Expand Up @@ -303,6 +307,8 @@ describe('examnet (just port)', () => {
callRm(`${mockEtcDir}/hosts.tmp`),
callIptablesList('nat', 'POSTROUTING'),
callIptablesList('nat', 'POSTROUTING'),
callIptablesList('filter', 'DOCKER-USER'),
callIptablesList('filter', 'DOCKER-USER'),
callIptablesList('filter', 'FORWARD'),
callIptablesList('filter', 'FORWARD'),
callIptablesList('filter', 'YTL_LAN_WAN_IPSET'),
Expand Down Expand Up @@ -476,8 +482,11 @@ describe('examnet (just port)', () => {
callIpLinkShow('eth1'),
callSysctl('1'),

callIptablesList('filter', 'DOCKER-USER'),
callIptablesList('nat', 'POSTROUTING'),
callIptablesList('nat', 'POSTROUTING'),
callIptablesList('filter', 'DOCKER-USER'),
callIptablesList('filter', 'DOCKER-USER'),
callIptablesList('filter', 'FORWARD'),
callIptablesList('filter', 'FORWARD'),
callIptablesList('filter', 'YTL_LAN_WAN_IPSET'),
Expand Down Expand Up @@ -510,12 +519,12 @@ describe('examnet (just port)', () => {
callIptablesCheckChain('filter', 'YTL_LAN_WAN_IPSET', '--jump DROP'),
callIptablesCheckChain(
'filter',
'FORWARD',
'DOCKER-USER',
'--in-interface eth0 --out-interface eth1 --match comment --comment ytl_internet_allowlist --match conntrack --ctstate RELATED,ESTABLISHED --jump ACCEPT'
),
callIptablesCheckChain(
'filter',
'FORWARD',
'DOCKER-USER',
'--in-interface eth1 --out-interface eth0 --match comment --comment ytl_internet_allowlist --jump YTL_LAN_WAN_IPSET'
),
callIptablesCheckChain(
Expand Down Expand Up @@ -555,8 +564,11 @@ describe('examnet (just port)', () => {
callIpLinkShow('eth1'),
callSysctl('1'),

callIptablesList('filter', 'DOCKER-USER'),
callIptablesList('nat', 'POSTROUTING'),
callIptablesList('nat', 'POSTROUTING'),
callIptablesList('filter', 'DOCKER-USER'),
callIptablesList('filter', 'DOCKER-USER'),
callIptablesList('filter', 'FORWARD'),
callIptablesList('filter', 'FORWARD'),
callIptablesList('filter', 'YTL_LAN_WAN_IPSET'),
Expand Down Expand Up @@ -618,8 +630,11 @@ describe('examnet (just port)', () => {
callIpLinkShow('eth1'),
callSysctl('1'),

callIptablesList('filter', 'DOCKER-USER'),
callIptablesList('nat', 'POSTROUTING'),
callIptablesList('nat', 'POSTROUTING'),
callIptablesList('filter', 'DOCKER-USER'),
callIptablesList('filter', 'DOCKER-USER'),
callIptablesList('filter', 'FORWARD'),
callIptablesList('filter', 'FORWARD'),
callIptablesList('filter', 'YTL_LAN_WAN_IPSET'),
Expand Down Expand Up @@ -651,12 +666,12 @@ describe('examnet (just port)', () => {
callIptablesCheckChain('filter', 'YTL_LAN_WAN_IPSET', '--jump DROP'),
callIptablesCheckChain(
'filter',
'FORWARD',
'DOCKER-USER',
'--in-interface eth0 --out-interface eth1 --match comment --comment ytl_internet_allowlist --match conntrack --ctstate RELATED,ESTABLISHED --jump ACCEPT'
),
callIptablesCheckChain(
'filter',
'FORWARD',
'DOCKER-USER',
'--in-interface eth1 --out-interface eth0 --match comment --comment ytl_internet_allowlist --jump YTL_LAN_WAN_IPSET'
),
callIptablesCheckChain(
Expand Down Expand Up @@ -813,8 +828,11 @@ describe('examnet (just port)', () => {
callIpLinkShow('eth1'),
callSysctl('1'),

callIptablesList('filter', 'DOCKER-USER'),
callIptablesList('nat', 'POSTROUTING'),
callIptablesList('nat', 'POSTROUTING'),
callIptablesList('filter', 'DOCKER-USER'),
callIptablesList('filter', 'DOCKER-USER'),
callIptablesList('filter', 'FORWARD'),
callIptablesList('filter', 'FORWARD'),
callIptablesList('filter', 'YTL_LAN_WAN_IPSET'),
Expand Down Expand Up @@ -846,12 +864,12 @@ describe('examnet (just port)', () => {
callIptablesCheckChain('filter', 'YTL_LAN_WAN_IPSET', '--jump DROP'),
callIptablesCheckChain(
'filter',
'FORWARD',
'DOCKER-USER',
'--in-interface eth0 --out-interface eth1 --match comment --comment ytl_internet_allowlist --match conntrack --ctstate RELATED,ESTABLISHED --jump ACCEPT'
),
callIptablesCheckChain(
'filter',
'FORWARD',
'DOCKER-USER',
'--in-interface eth1 --out-interface eth0 --match comment --comment ytl_internet_allowlist --jump YTL_LAN_WAN_IPSET'
),
callIptablesCheckChain(
Expand Down
Loading