secubox/secubox-deb
1
0
Fork 0
mirror of https://github.com/CyberMind-FR/secubox-deb.git synced 2026-07-29 13:59:40 +00:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

fix(vortex-firewall): unmask + enable nftables at install so LXC NAT survives reboot (closes #150)

Browse Source 
nftables.service was masked on the board, so /etc/nftables.conf (LXC MASQUERADE
+ include /etc/nftables.d/*.nft) never loaded at boot — every reboot dropped
outbound for all 10.100.0.0/24 LXCs (apt/DNS failures inside containers). The
firewall postinst now unmasks + enables nftables.service so it loads at boot,
ordered before the CrowdSec bouncer. Not force-started (avoids flushing live
CrowdSec tables). Bump 1.0.1 -> 1.0.2.
This commit is contained in:
CyberMind-FR 2026-05-29 09:37:06 +02:00
parent d8aa6915e3
commit 05bee75da4
2 changed files with 22 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
packages/secubox-vortex-firewall/debian/changelog
View File

@ -1,3 +1,14 @@
secubox-vortex-firewall (1.0.2-1~bookworm1) bookworm; urgency=medium
* postinst: unmask + enable nftables.service (closes #150). It was found
masked (symlink to /dev/null) on the board, so /etc/nftables.conf — which
carries the LXC MASQUERADE rule and `include /etc/nftables.d/*.nft` — never
loaded at boot, and every reboot left 10.100.0.0/24 LXCs with no outbound
NAT (apt/DNS broken inside containers). Not force-started in postinst to
avoid flushing CrowdSec's live tables; boot-time enable is the durable fix.
-- Gerald KERMA <devel@cybermind.fr> Fri, 29 May 2026 08:15:00 +0000
secubox-vortex-firewall (1.0.1-1~bookworm1) bookworm; urgency=low
* Rewrite Description to identify this as the nftables threat-feed

11
packages/secubox-vortex-firewall/debian/postinst
View File

@ -19,6 +19,17 @@ EOF
nginx -t 2>/dev/null && systemctl reload nginx 2>/dev/null || true
fi
# Ensure the system nftables.service actually loads /etc/nftables.conf at
# boot. That file holds the LXC NAT (`ip saddr 10.100.0.0/24 oif lan0
# masquerade`) and `include "/etc/nftables.d/*.nft"`. On the board it was
# found masked (symlink to /dev/null), so after every reboot the kernel had
# no NAT and all 10.100.0.0/24 LXCs lost outbound (#150). Unmask + enable so
# it loads at boot, ordered before the CrowdSec bouncer adds its own tables.
# Not force-started here: a live `nft -f` flushes the ruleset and would
# momentarily drop CrowdSec's live tables — boot-time loading is the fix.
systemctl unmask nftables.service 2>/dev/null || true
systemctl enable nftables.service 2>/dev/null || true
systemctl daemon-reload
systemctl enable secubox-vortex-firewall.service || true
systemctl start secubox-vortex-firewall.service || true