From 65b321f73b76f52dd7b6e23f2c1bfeff3eee375e Mon Sep 17 00:00:00 2001
From: Benjamin Toby <devops@tben.me>
Date: Sun, 27 Sep 2026 15:40:05 +0100
Subject: [PATCH] Iptables restrictions bugfix: #1

---
 .../setup/build-host-iptables-scripts.ts      | 127 ++++++++++++++----
 1 file changed, 98 insertions(+), 29 deletions(-)

diff --git a/src/functions/backend/setup/build-host-iptables-scripts.ts b/src/functions/backend/setup/build-host-iptables-scripts.ts
index be26ae3..5befcb2 100644
--- a/src/functions/backend/setup/build-host-iptables-scripts.ts
+++ b/src/functions/backend/setup/build-host-iptables-scripts.ts
@@ -79,16 +79,58 @@ function chunkPorts({ ports }: { ports: string[] }) {
     return chunks;
 }
 
+// function acceptLines({
+//     chain,
+//     source,
+//     destination,
+//     protocol,
+//     ports,
+// }: {
+//     chain: string;
+//     source: string;
+//     destination?: string;
+//     protocol?: string;
+//     ports: string[];
+// }) {
+//     const lines: string[] = [];
+//     const protocols = protocolsForRule({
+//         protocol,
+//         has_ports: Boolean(ports[0]),
+//     });
+//     const port_chunks = ports[0] ? chunkPorts({ ports }) : [[]];
+
+//     for (let p = 0; p < protocols.length; p++) {
+//         const proto = protocols[p];
+
+//         for (let c = 0; c < port_chunks.length; c++) {
+//             const chunk = port_chunks[c] || [];
+
+//             lines.push(
+//                 joinArgs([
+//                     `iptables -A ${chain}`,
+//                     `-s ${source}`,
+//                     destination ? `-d ${destination}` : undefined,
+//                     proto ? `-p ${proto}` : undefined,
+//                     proto ? portMatch({ ports: chunk }) : undefined,
+//                     `-j ACCEPT`,
+//                 ]),
+//             );
+//         }
+//     }
+
+//     return lines;
+// }
+
 function acceptLines({
-    chain,
+    forward_chain,
+    input_chain,
     source,
-    destination,
     protocol,
     ports,
 }: {
-    chain: string;
+    forward_chain: string;
+    input_chain: string;
     source: string;
-    destination?: string;
     protocol?: string;
     ports: string[];
 }) {
@@ -104,14 +146,28 @@ function acceptLines({
 
         for (let c = 0; c < port_chunks.length; c++) {
             const chunk = port_chunks[c] || [];
+            const port_match_str = proto
+                ? portMatch({ ports: chunk })
+                : undefined;
 
+            // 1. FORWARD chain: Allows routed traffic (including Docker bridges/DNAT)
             lines.push(
                 joinArgs([
-                    `iptables -A ${chain}`,
+                    `iptables -A ${forward_chain}`,
                     `-s ${source}`,
-                    destination ? `-d ${destination}` : undefined,
                     proto ? `-p ${proto}` : undefined,
-                    proto ? portMatch({ ports: chunk }) : undefined,
+                    port_match_str,
+                    `-j ACCEPT`,
+                ]),
+            );
+
+            // 2. INPUT chain: Allows traffic bound directly for host OS services
+            lines.push(
+                joinArgs([
+                    `iptables -A ${input_chain}`,
+                    `-s ${source}`,
+                    proto ? `-p ${proto}` : undefined,
+                    port_match_str,
                     `-j ACCEPT`,
                 ]),
             );
@@ -128,11 +184,7 @@ export default function buildHostIptablesScripts({
     host_subnet,
     clients,
 }: Params) {
-    if (
-        !Number.isSafeInteger(host_id) ||
-        host_id < 0 ||
-        host_id > 999999999
-    ) {
+    if (!Number.isSafeInteger(host_id) || host_id < 0 || host_id > 999999999) {
         return {
             success: false,
             msg: `Invalid host id`,
@@ -164,9 +216,7 @@ export default function buildHostIptablesScripts({
 
     const { forward, input } = deriveIptablesChainNames({ host_id });
 
-    const masquerade_match = scoped_subnet
-        ? `-s ${scoped_subnet} -o ${target_interface}`
-        : `-o ${target_interface}`;
+    const masquerade_match = scoped_subnet ? `-s ${scoped_subnet} ` : ``;
     const accept_lines: string[] = [];
     const host_clients = clients || [];
 
@@ -212,19 +262,28 @@ export default function buildHostIptablesScripts({
                 };
             }
 
+            // if (rule.rule_type == "all") {
+            //     if (scoped_subnet) {
+            //         accept_lines.push(
+            //             `iptables -A ${forward} -s ${source} -d ${scoped_subnet} -j ACCEPT`,
+            //             `iptables -A ${forward} -s ${source} -o ${target_interface} -j ACCEPT`,
+            //             `iptables -A ${input} -s ${source} -j ACCEPT`,
+            //         );
+            //     } else {
+            //         accept_lines.push(
+            //             `iptables -A ${forward} -s ${source} -j ACCEPT`,
+            //             `iptables -A ${input} -s ${source} -j ACCEPT`,
+            //         );
+            //     }
+
+            //     continue;
+            // }
+
             if (rule.rule_type == "all") {
-                if (scoped_subnet) {
-                    accept_lines.push(
-                        `iptables -A ${forward} -s ${source} -d ${scoped_subnet} -j ACCEPT`,
-                        `iptables -A ${forward} -s ${source} -o ${target_interface} -j ACCEPT`,
-                        `iptables -A ${input} -s ${source} -j ACCEPT`,
-                    );
-                } else {
-                    accept_lines.push(
-                        `iptables -A ${forward} -s ${source} -j ACCEPT`,
-                        `iptables -A ${input} -s ${source} -j ACCEPT`,
-                    );
-                }
+                accept_lines.push(
+                    `iptables -A ${forward} -s ${source} -j ACCEPT`,
+                    `iptables -A ${input} -s ${source} -j ACCEPT`,
+                );
 
                 continue;
             }
@@ -241,11 +300,21 @@ export default function buildHostIptablesScripts({
                 };
             }
 
+            // accept_lines.push(
+            //     ...acceptLines({
+            //         chain: forward,
+            //         source,
+            //         destination,
+            //         protocol: rule.protocol || "any",
+            //         ports: parsed_ports.ports,
+            //     }),
+            // );
+
             accept_lines.push(
                 ...acceptLines({
-                    chain: forward,
+                    forward_chain: forward,
+                    input_chain: input,
                     source,
-                    destination,
                     protocol: rule.protocol || "any",
                     ports: parsed_ports.ports,
                 }),