feat: first fully successful run e2e on straper

1 files changed, 264 insertions, 0 deletions

diff --git a/straper/db/public/firewall/nft-ruleset.txt b/straper/db/public/firewall/nft-ruleset.txt
new file mode 100644
index 0000000..45ac4ae
--- /dev/null
+++ b/straper/db/public/firewall/nft-ruleset.txt
@@ -0,0 +1,264 @@
+table inet nat {
+	chain postrouting {
+		type nat hook postrouting priority srcnat; policy accept;
+		oifname "enx00e04c2e4828" ip saddr 10.50.0.0/24 counter packets 0 bytes 0 masquerade
+	}
+}
+table inet filter {
+	chain input {
+		type filter hook input priority filter; policy drop;
+		iif "lo" accept
+		ct state invalid drop
+		ct state { established, related } accept
+		ip saddr 10.50.0.0/24 udp dport 53 accept
+		ip saddr 10.50.0.0/24 tcp dport 53 accept
+		ip saddr 192.168.33.0/24 udp dport 53 accept
+		ip saddr 192.168.33.0/24 tcp dport 53 accept
+		ip saddr 172.22.0.0/16 udp dport 53 accept
+		ip saddr 172.22.0.0/16 tcp dport 53 accept
+		ip protocol icmp accept
+		ip6 nexthdr ipv6-icmp accept
+		ip saddr 192.168.33.0/24 tcp dport 2222 ct state new accept
+		iifname "wg0" tcp dport 2222 ct state new accept
+		iifname "wg0" tcp dport 8080 ct state new accept
+		iifname "wg0" tcp dport 3000 ct state new accept
+		iifname "wg0" tcp dport { 3001, 8002 } ct state new accept
+		iifname "wg0" tcp dport 3300 ct state new accept
+		udp dport 52220 accept
+		udp sport 67 udp dport 68 accept
+		ip saddr 192.168.33.0/24 tcp dport 57385 ct state new limit rate 15/minute burst 5 packets counter packets 24 bytes 1440 accept
+		ip saddr 192.168.33.0/24 tcp dport 8000 ct state new counter packets 0 bytes 0 accept
+		tcp dport 57385 ct state new limit rate 30/minute burst 20 packets counter packets 7285 bytes 439500 accept
+		tcp dport { 443, 9080 } ct state new accept
+		ct state new tcp dport 52220 accept
+		ct state new tcp dport 52690 accept
+		tcp dport 64738 ct state new accept
+		udp dport 64738 accept
+		tcp dport 1965 ct state new accept
+		tcp dport 70 ct state new accept
+		counter packets 100331 bytes 24311938 drop
+		ip saddr { 10.50.0.0/24, 192.168.33.0/24 } tcp dport { 5055, 8502 } ct state new accept
+		ip saddr { 10.50.0.0/24, 192.168.33.0/24 } tcp dport { 3100, 9090, 9095, 9096, 9100, 9516 } ct state new accept
+		ip saddr 192.168.33.0/24 tcp dport 3300 ct state new accept
+		tcp dport 5355 drop
+		udp dport 5355 drop
+		ip saddr != { 10.50.0.0/24, 192.168.33.0/24 } tcp dport 8000 drop
+	}
+
+	chain forward {
+		type filter hook forward priority filter; policy drop;
+		ct state { established, related } accept
+		iifname "wg0" oifname "enx00e04c2e4828" counter packets 0 bytes 0 accept
+		iifname "wg0" accept
+		iifname "enx00e04c2e4828" oifname "wg0" accept
+		iif "enx00e04c2e4828" oifname "br-*" accept
+		iifname "br-*" oif "enx00e04c2e4828" accept
+		iifname "br-*" oifname "wg0" accept
+	}
+
+	chain output {
+		type filter hook output priority filter; policy accept;
+	}
+}
+# Warning: table ip nat is managed by iptables-nft, do not touch!
+table ip nat {
+	chain DOCKER {
+		ip daddr 10.50.0.1 iifname != "br-07462fa2c80e" tcp dport 8080 counter packets 4430 bytes 265800 dnat to 172.18.0.2:8080
+		ip daddr 127.0.0.1 iifname != "br-454eb7778b0a" tcp dport 8081 counter packets 0 bytes 0 dnat to 172.19.0.2:8080
+		iifname != "br-3d1818651f84" tcp dport 5055 counter packets 0 bytes 0 dnat to 172.26.0.3:5055
+		iifname != "br-3d1818651f84" tcp dport 8502 counter packets 0 bytes 0 dnat to 172.26.0.3:8502
+		ip daddr 127.0.0.1 iifname != "br-ed53bc5d2155" tcp dport 9081 counter packets 0 bytes 0 dnat to 172.20.0.2:80
+		ip daddr 127.0.0.1 iifname != "br-de49ada7ecfc" tcp dport 9091 counter packets 0 bytes 0 dnat to 172.21.0.4:80
+		ip daddr 127.0.0.1 iifname != "br-7ad976d6055e" tcp dport 9001 counter packets 0 bytes 0 dnat to 172.25.0.2:9001
+		iifname != "br-0a3c12139db8" tcp dport 8000 counter packets 0 bytes 0 dnat to 172.23.0.4:8000
+		ip daddr 127.0.0.1 iifname != "br-bebca6296b94" tcp dport 3101 counter packets 0 bytes 0 dnat to 172.24.0.2:3000
+		ip daddr 127.0.0.1 iifname != "br-bebca6296b94" tcp dport 3103 counter packets 0 bytes 0 dnat to 172.24.0.2:3003
+		iifname != "br-8f7fc81a0600" tcp dport 2222 counter packets 9 bytes 540 dnat to 172.30.0.2:22
+		iifname != "br-8f7fc81a0600" tcp dport 3300 counter packets 318 bytes 19080 dnat to 172.30.0.2:3000
+		ip daddr 10.50.0.1 iifname != "br-e2d8a9eac20e" tcp dport 3001 counter packets 19 bytes 1138 dnat to 172.22.0.2:3001
+	}
+
+	chain PREROUTING {
+		type nat hook prerouting priority dstnat; policy accept;
+		fib daddr type local counter packets 249517 bytes 32928887 jump DOCKER
+	}
+
+	chain OUTPUT {
+		type nat hook output priority dstnat; policy accept;
+		ip daddr != 127.0.0.0/8 fib daddr type local counter packets 5296 bytes 317760 jump DOCKER
+	}
+
+	chain POSTROUTING {
+		type nat hook postrouting priority srcnat; policy accept;
+		ip saddr 172.23.0.0/16 oifname != "br-0a3c12139db8" counter packets 0 bytes 0 masquerade
+		ip saddr 172.17.0.0/16 oifname != "docker0" counter packets 0 bytes 0 masquerade
+		ip saddr 172.21.0.0/16 oifname != "br-de49ada7ecfc" counter packets 6 bytes 360 masquerade
+		ip saddr 172.26.0.0/16 oifname != "br-3d1818651f84" counter packets 3 bytes 180 masquerade
+		ip saddr 172.22.0.0/16 oifname != "br-2fd0bcdb4679" counter packets 32880 bytes 2067095 masquerade
+		ip saddr 172.18.0.0/16 oifname != "br-07462fa2c80e" counter packets 287 bytes 17220 masquerade
+		ip saddr 172.20.0.0/16 oifname != "br-ed53bc5d2155" counter packets 2 bytes 120 masquerade
+		ip saddr 172.24.0.0/16 oifname != "br-bebca6296b94" counter packets 3 bytes 180 masquerade
+		ip saddr 172.25.0.0/16 oifname != "br-7ad976d6055e" counter packets 0 bytes 0 masquerade
+		ip saddr 172.19.0.0/16 oifname != "br-454eb7778b0a" counter packets 0 bytes 0 masquerade
+	}
+}
+table ip filter {
+	chain DOCKER {
+		ip daddr 172.22.0.2 iifname != "br-e2d8a9eac20e" oifname "br-e2d8a9eac20e" tcp dport 3001 counter packets 0 bytes 0 accept
+		ip daddr 172.30.0.2 iifname != "br-8f7fc81a0600" oifname "br-8f7fc81a0600" tcp dport 3000 counter packets 0 bytes 0 accept
+		ip daddr 172.30.0.2 iifname != "br-8f7fc81a0600" oifname "br-8f7fc81a0600" tcp dport 22 counter packets 0 bytes 0 accept
+		ip daddr 172.24.0.2 iifname != "br-bebca6296b94" oifname "br-bebca6296b94" tcp dport 3003 counter packets 0 bytes 0 accept
+		ip daddr 172.24.0.2 iifname != "br-bebca6296b94" oifname "br-bebca6296b94" tcp dport 3000 counter packets 0 bytes 0 accept
+		ip daddr 172.23.0.4 iifname != "br-0a3c12139db8" oifname "br-0a3c12139db8" tcp dport 8000 counter packets 0 bytes 0 accept
+		ip daddr 172.25.0.2 iifname != "br-7ad976d6055e" oifname "br-7ad976d6055e" tcp dport 9001 counter packets 0 bytes 0 accept
+		ip daddr 172.21.0.4 iifname != "br-de49ada7ecfc" oifname "br-de49ada7ecfc" tcp dport 80 counter packets 0 bytes 0 accept
+		ip daddr 172.20.0.2 iifname != "br-ed53bc5d2155" oifname "br-ed53bc5d2155" tcp dport 80 counter packets 0 bytes 0 accept
+		ip daddr 172.26.0.3 iifname != "br-3d1818651f84" oifname "br-3d1818651f84" tcp dport 8502 counter packets 0 bytes 0 accept
+		ip daddr 172.26.0.3 iifname != "br-3d1818651f84" oifname "br-3d1818651f84" tcp dport 5055 counter packets 0 bytes 0 accept
+		ip daddr 172.19.0.2 iifname != "br-454eb7778b0a" oifname "br-454eb7778b0a" tcp dport 8080 counter packets 0 bytes 0 accept
+		ip daddr 172.18.0.2 iifname != "br-07462fa2c80e" oifname "br-07462fa2c80e" tcp dport 8080 counter packets 0 bytes 0 accept
+		iifname != "br-454eb7778b0a" oifname "br-454eb7778b0a" counter packets 0 bytes 0 drop
+		iifname != "br-7ad976d6055e" oifname "br-7ad976d6055e" counter packets 0 bytes 0 drop
+		iifname != "br-bebca6296b94" oifname "br-bebca6296b94" counter packets 0 bytes 0 drop
+		iifname != "br-ed53bc5d2155" oifname "br-ed53bc5d2155" counter packets 0 bytes 0 drop
+		iifname != "br-07462fa2c80e" oifname "br-07462fa2c80e" counter packets 0 bytes 0 drop
+		iifname != "br-2fd0bcdb4679" oifname "br-2fd0bcdb4679" counter packets 0 bytes 0 drop
+		iifname != "br-3d1818651f84" oifname "br-3d1818651f84" counter packets 0 bytes 0 drop
+		iifname != "br-de49ada7ecfc" oifname "br-de49ada7ecfc" counter packets 0 bytes 0 drop
+		iifname != "docker0" oifname "docker0" counter packets 0 bytes 0 drop
+		iifname != "br-0a3c12139db8" oifname "br-0a3c12139db8" counter packets 0 bytes 0 drop
+	}
+
+	chain DOCKER-FORWARD {
+		counter packets 1321965 bytes 698498753 jump DOCKER-CT
+		counter packets 1307852 bytes 661726331 jump DOCKER-INTERNAL
+		counter packets 1307852 bytes 661726331 jump DOCKER-BRIDGE
+		iifname "br-454eb7778b0a" counter packets 0 bytes 0 accept
+		iifname "br-7ad976d6055e" counter packets 0 bytes 0 accept
+		iifname "br-bebca6296b94" counter packets 40 bytes 8333 accept
+		iifname "br-ed53bc5d2155" counter packets 37 bytes 4045 accept
+		iifname "br-07462fa2c80e" counter packets 7631 bytes 1205643 accept
+		iifname "br-2fd0bcdb4679" counter packets 0 bytes 0 accept
+		iifname "br-3d1818651f84" counter packets 143 bytes 153471 accept
+		iifname "br-de49ada7ecfc" counter packets 2928 bytes 163686 accept
+		iifname "docker0" counter packets 0 bytes 0 accept
+		iifname "br-0a3c12139db8" counter packets 0 bytes 0 accept
+	}
+
+	chain DOCKER-BRIDGE {
+		oifname "br-454eb7778b0a" counter packets 0 bytes 0 jump DOCKER
+		oifname "br-7ad976d6055e" counter packets 0 bytes 0 jump DOCKER
+		oifname "br-bebca6296b94" counter packets 0 bytes 0 jump DOCKER
+		oifname "br-ed53bc5d2155" counter packets 0 bytes 0 jump DOCKER
+		oifname "br-07462fa2c80e" counter packets 0 bytes 0 jump DOCKER
+		oifname "br-2fd0bcdb4679" counter packets 0 bytes 0 jump DOCKER
+		oifname "br-3d1818651f84" counter packets 0 bytes 0 jump DOCKER
+		oifname "br-de49ada7ecfc" counter packets 0 bytes 0 jump DOCKER
+		oifname "docker0" counter packets 0 bytes 0 jump DOCKER
+		oifname "br-0a3c12139db8" counter packets 0 bytes 0 jump DOCKER
+	}
+
+	chain DOCKER-CT {
+		oifname "br-454eb7778b0a" ct state established,related counter packets 0 bytes 0 accept
+		oifname "br-7ad976d6055e" ct state established,related counter packets 0 bytes 0 accept
+		oifname "br-bebca6296b94" ct state established,related counter packets 37 bytes 12496 accept
+		oifname "br-ed53bc5d2155" ct state established,related counter packets 33 bytes 25191 accept
+		oifname "br-07462fa2c80e" ct state established,related counter packets 9081 bytes 12474633 accept
+		oifname "br-2fd0bcdb4679" ct state established,related counter packets 0 bytes 0 accept
+		oifname "br-3d1818651f84" ct state established,related counter packets 257 bytes 2107982 accept
+		oifname "br-de49ada7ecfc" ct state established,related counter packets 4705 bytes 22152120 accept
+		oifname "docker0" ct state established,related counter packets 0 bytes 0 accept
+		oifname "br-0a3c12139db8" ct state established,related counter packets 0 bytes 0 accept
+	}
+
+	chain DOCKER-INTERNAL {
+	}
+
+	chain FORWARD {
+		type filter hook forward priority filter; policy accept;
+		counter packets 1321965 bytes 698498753 jump DOCKER-USER
+		counter packets 1321965 bytes 698498753 jump DOCKER-FORWARD
+	}
+
+	chain DOCKER-USER {
+	}
+}
+table ip6 nat {
+	chain DOCKER {
+	}
+
+	chain PREROUTING {
+		type nat hook prerouting priority dstnat; policy accept;
+		fib daddr type local counter packets 0 bytes 0 jump DOCKER
+	}
+
+	chain OUTPUT {
+		type nat hook output priority dstnat; policy accept;
+		ip6 daddr != ::1 fib daddr type local counter packets 0 bytes 0 jump DOCKER
+	}
+}
+table ip6 filter {
+	chain DOCKER {
+	}
+
+	chain DOCKER-FORWARD {
+		counter packets 0 bytes 0 jump DOCKER-CT
+		counter packets 0 bytes 0 jump DOCKER-INTERNAL
+		counter packets 0 bytes 0 jump DOCKER-BRIDGE
+	}
+
+	chain DOCKER-BRIDGE {
+	}
+
+	chain DOCKER-CT {
+	}
+
+	chain DOCKER-INTERNAL {
+	}
+
+	chain FORWARD {
+		type filter hook forward priority filter; policy accept;
+		counter packets 0 bytes 0 jump DOCKER-USER
+		counter packets 0 bytes 0 jump DOCKER-FORWARD
+	}
+
+	chain DOCKER-USER {
+	}
+}
+table ip raw {
+	chain PREROUTING {
+		type filter hook prerouting priority raw; policy accept;
+		ip daddr 172.21.0.2 iifname != "br-de49ada7ecfc" counter packets 0 bytes 0 drop
+		ip daddr 172.26.0.2 iifname != "br-3d1818651f84" counter packets 0 bytes 0 drop
+		ip daddr 172.21.0.3 iifname != "br-de49ada7ecfc" counter packets 0 bytes 0 drop
+		ip daddr 172.26.0.3 iifname != "br-3d1818651f84" counter packets 0 bytes 0 drop
+		ip daddr 172.18.0.2 iifname != "br-07462fa2c80e" counter packets 0 bytes 0 drop
+		ip daddr 172.19.0.2 iifname != "br-454eb7778b0a" counter packets 0 bytes 0 drop
+		ip daddr 172.20.0.2 iifname != "br-ed53bc5d2155" counter packets 0 bytes 0 drop
+		ip daddr 172.21.0.4 iifname != "br-de49ada7ecfc" counter packets 0 bytes 0 drop
+		ip daddr 172.25.0.2 iifname != "br-7ad976d6055e" counter packets 0 bytes 0 drop
+		ip daddr 127.0.0.1 iifname != "lo" tcp dport 8081 counter packets 0 bytes 0 drop
+		ip daddr 127.0.0.1 iifname != "lo" tcp dport 9081 counter packets 0 bytes 0 drop
+		ip daddr 127.0.0.1 iifname != "lo" tcp dport 9091 counter packets 0 bytes 0 drop
+		ip daddr 127.0.0.1 iifname != "lo" tcp dport 9001 counter packets 0 bytes 0 drop
+		ip daddr 172.23.0.2 iifname != "br-0a3c12139db8" counter packets 0 bytes 0 drop
+		ip daddr 172.23.0.3 iifname != "br-0a3c12139db8" counter packets 0 bytes 0 drop
+		ip daddr 172.23.0.4 iifname != "br-0a3c12139db8" counter packets 0 bytes 0 drop
+		ip daddr 172.24.0.2 iifname != "br-bebca6296b94" counter packets 0 bytes 0 drop
+		ip daddr 127.0.0.1 iifname != "lo" tcp dport 3101 counter packets 0 bytes 0 drop
+		ip daddr 127.0.0.1 iifname != "lo" tcp dport 3103 counter packets 0 bytes 0 drop
+		ip daddr 127.0.0.1 iifname != "lo" tcp dport 8000 ip saddr != 192.168.33.0/24 counter packets 0 bytes 0 drop
+		ip daddr 172.30.0.2 iifname != "br-8f7fc81a0600" counter packets 0 bytes 0 drop
+	}
+}
+table inet f2b-table {
+	set addr-set-sshd {
+		type ipv4_addr
+		flags interval
+	}
+
+	chain f2b-chain {
+		type filter hook input priority filter - 1; policy accept;
+		meta l4proto tcp ip saddr @addr-set-sshd reject with icmp port-unreachable
+	}
+}