secubox/secubox-deb
1
0
Fork 0
mirror of https://github.com/CyberMind-FR/secubox-deb.git synced 2026-07-28 21:17:36 +00:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

fix(toolbox): drop QUIC (UDP443) BEFORE the outbound accept — was after → never fired → HTTP/3 bypassed the whole MITM (no inject/adblock/metrics/social) (ref #662)
Some checks are pending
License Headers / check (push) Waiting to run
Details

Browse Source
This commit is contained in:
CyberMind-FR 2026-06-19 11:10:29 +02:00
parent 27ba48c1a1
commit a48f43607b
1 changed files with 7 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
packages/secubox-toolbox/nftables.d/secubox-toolbox-wg.nft
View File

@ -51,13 +51,16 @@ table inet wg-toolbox {
chain forward {
type filter hook forward priority filter; policy accept;
# Phase 6.K / #662 — drop UDP 443 (QUIC/HTTP3) FIRST, before the blanket
# outbound accept below. If it sits AFTER the accept it is never reached
# (the accept terminates evaluation) → QUIC slips through and the whole
# MITM is bypassed (no inject, no ad-block, no metrics, no social). The
# drop forces Chrome/Firefox to fall back to HTTP/2 over TCP, which our
# DNAT intercepts. ORDER IS LOAD-BEARING — keep this rule first.
iif "wg-toolbox" udp dport 443 counter drop
# Outbound from tunnel → internet
iif "wg-toolbox" oif "lan0" accept
# Return traffic
iif "lan0" oif "wg-toolbox" ct state established,related accept
# Phase 6.K — drop UDP 443 (QUIC/HTTP3) so browsers fall back to
# HTTP/2 over TCP, which our DNAT can intercept. Without this,
# Chrome/Firefox prefer QUIC and bypass mitm entirely.
iif "wg-toolbox" udp dport 443 counter drop
}
}