Iptables restrictions bugfix: #3: Restrict inter-host access

src/functions/backend/setup/build-host-iptables-scripts.ts

@@ -127,12 +127,14 @@ function acceptLines({
     source,
     protocol,
     ports,
+    host_wg_ip,
 }: {
     forward_chain: string;
     input_chain: string;
     source: string;
     protocol?: string;
     ports: string[];
+    host_wg_ip?: string;
 }) {
     const lines: string[] = [];
     const protocols = protocolsForRule({
@@ -150,7 +152,7 @@ function acceptLines({
                 ? portMatch({ ports: chunk })
                 : undefined;
 
-            // 1. FORWARD chain: Allows routed traffic (including Docker bridges/DNAT)
+            // FORWARD: Forwarded ports / Docker containers / WAN
             lines.push(
                 joinArgs([
                     `iptables -A ${forward_chain}`,
@@ -161,16 +163,39 @@ function acceptLines({
                 ]),
             );
 
-            // 2. INPUT chain: Allows traffic bound directly for host OS services
+            // INPUT: Only allow matching requests bound for THIS interface's host IP
             lines.push(
                 joinArgs([
                     `iptables -A ${input_chain}`,
                     `-s ${source}`,
+                    host_wg_ip ? `-d ${host_wg_ip}` : undefined,
                     proto ? `-p ${proto}` : undefined,
                     port_match_str,
                     `-j ACCEPT`,
                 ]),
             );
+
+            // // 1. FORWARD chain: Allows routed traffic (including Docker bridges/DNAT)
+            // lines.push(
+            //     joinArgs([
+            //         `iptables -A ${forward_chain}`,
+            //         `-s ${source}`,
+            //         proto ? `-p ${proto}` : undefined,
+            //         port_match_str,
+            //         `-j ACCEPT`,
+            //     ]),
+            // );
+
+            // // 2. INPUT chain: Allows traffic bound directly for host OS services
+            // lines.push(
+            //     joinArgs([
+            //         `iptables -A ${input_chain}`,
+            //         `-s ${source}`,
+            //         proto ? `-p ${proto}` : undefined,
+            //         port_match_str,
+            //         `-j ACCEPT`,
+            //     ]),
+            // );
         }
     }
 
@@ -282,7 +307,10 @@ export default function buildHostIptablesScripts({
             if (rule.rule_type == "all") {
                 accept_lines.push(
                     `iptables -A ${forward} -s ${source} -j ACCEPT`,
-                    `iptables -A ${input} -s ${source} -j ACCEPT`,
+                    // `iptables -A ${input} -s ${source} -j ACCEPT`,
+                    scoped_subnet
+                        ? `iptables -A ${input} -s ${source} -d ${scoped_subnet} -j ACCEPT`
+                        : `iptables -A ${input} -s ${source} -j ACCEPT`,
                 );
 
                 continue;
@@ -317,6 +345,7 @@ export default function buildHostIptablesScripts({
                     source,
                     protocol: rule.protocol || "any",
                     ports: parsed_ports.ports,
+                    host_wg_ip: scoped_subnet,
                 }),
             );
         }