[A·M2] nftables enforcement: deception → engine, real → DNAT #17

New issue

Closed

opened 2026-06-24 23:50:02 +00:00 by vxfemboy · 2 comments

vxfemboy commented

2026-06-24 23:50:02 +00:00

(Migrated from github.com)

Wire the classifier rules deferred in M1: deception set → NFQUEUE/TPROXY to the engine, real services → DNAT to backend, drop set → drop. Remove the inert accept-all placeholder. Part of #2.

vxfemboy commented

2026-07-04 06:46:23 +00:00

(Migrated from github.com)

The real→DNAT half of this issue is now implemented and merged in #98: a dedicated nat prerouting chain emits a per-service dnat to <ip>:<port> rule for nat: targets (host:/incus: keep the plain accept; cross-family targets skipped). Deception→engine enforcement (TPROXY + NFQUEUE) landed earlier. Leaving this open for any remaining M2 enforcement scope.

The real→DNAT half of this issue is now implemented and merged in #98: a dedicated `nat` prerouting chain emits a per-service `dnat to <ip>:<port>` rule for `nat:` targets (`host:`/`incus:` keep the plain accept; cross-family targets skipped). Deception→engine enforcement (TPROXY + NFQUEUE) landed earlier. Leaving this open for any remaining M2 enforcement scope.

vxfemboy commented

2026-07-09 04:33:40 +00:00

(Migrated from github.com)

Implemented. blackwall-nft::render (crates/blackwall-nft/src/render.rs) now emits the full M2 classifier — the inert accept-all placeholder is gone:

real services → accept + DNAT: rule 6 accepts iifname-scoped real-service membership; nat:<ip>:<port> backends are rewritten in a dedicated nat chain at dstnat priority (render.rs:493+).
deception → engine: TCP on managed prefixes tproxy's to the engine port (rule 8), with stateless-TCP ports diverted to NFQUEUE first (rule 7); deception ICMP/UDP → NFQUEUE (rule 9). The tproxy verdict-ordering fix landed in #157.
drop: when default_state == Closed the chain's default policy is drop.

Enforced end-to-end by the deception-* lab gates (all green). Closing.

Implemented. `blackwall-nft::render` (crates/blackwall-nft/src/render.rs) now emits the full M2 classifier — the inert accept-all placeholder is gone: - **real services → accept + DNAT**: rule 6 accepts `iifname`-scoped real-service membership; `nat:<ip>:<port>` backends are rewritten in a dedicated `nat` chain at `dstnat` priority (render.rs:493+). - **deception → engine**: TCP on managed prefixes tproxy's to the engine port (rule 8), with stateless-TCP ports diverted to NFQUEUE first (rule 7); deception ICMP/UDP → NFQUEUE (rule 9). The tproxy verdict-ordering fix landed in #157. - **drop**: when `default_state == Closed` the chain's default policy is `drop`. Enforced end-to-end by the deception-* lab gates (all green). Closing.