From a48f43607b5aec27ca205898d994fc5fcde7d5c0 Mon Sep 17 00:00:00 2001 From: CyberMind-FR Date: Fri, 19 Jun 2026 11:10:29 +0200 Subject: [PATCH] =?UTF-8?q?fix(toolbox):=20drop=20QUIC=20(UDP443)=20BEFORE?= =?UTF-8?q?=20the=20outbound=20accept=20=E2=80=94=20was=20after=20?= =?UTF-8?q?=E2=86=92=20never=20fired=20=E2=86=92=20HTTP/3=20bypassed=20the?= =?UTF-8?q?=20whole=20MITM=20(no=20inject/adblock/metrics/social)=20(ref?= =?UTF-8?q?=20#662)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../secubox-toolbox/nftables.d/secubox-toolbox-wg.nft | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/packages/secubox-toolbox/nftables.d/secubox-toolbox-wg.nft b/packages/secubox-toolbox/nftables.d/secubox-toolbox-wg.nft index 5d87bf45..ef7843e5 100644 --- a/packages/secubox-toolbox/nftables.d/secubox-toolbox-wg.nft +++ b/packages/secubox-toolbox/nftables.d/secubox-toolbox-wg.nft @@ -51,13 +51,16 @@ table inet wg-toolbox { chain forward { type filter hook forward priority filter; policy accept; + # Phase 6.K / #662 — drop UDP 443 (QUIC/HTTP3) FIRST, before the blanket + # outbound accept below. If it sits AFTER the accept it is never reached + # (the accept terminates evaluation) → QUIC slips through and the whole + # MITM is bypassed (no inject, no ad-block, no metrics, no social). The + # drop forces Chrome/Firefox to fall back to HTTP/2 over TCP, which our + # DNAT intercepts. ORDER IS LOAD-BEARING — keep this rule first. + iif "wg-toolbox" udp dport 443 counter drop # Outbound from tunnel → internet iif "wg-toolbox" oif "lan0" accept # Return traffic iif "lan0" oif "wg-toolbox" ct state established,related accept - # Phase 6.K — drop UDP 443 (QUIC/HTTP3) so browsers fall back to - # HTTP/2 over TCP, which our DNAT can intercept. Without this, - # Chrome/Firefox prefer QUIC and bypass mitm entirely. - iif "wg-toolbox" udp dport 443 counter drop } }