secubox/secubox-deb
1
0
Fork 0
mirror of https://github.com/CyberMind-FR/secubox-deb.git synced 2026-07-29 09:14:33 +00:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

fix(toolbox): persist R3 fanout to the Go engine ports 809x (was 808x Python) (ref #662)
Some checks are pending
License Headers / check (push) Waiting to run
Details

Browse Source 
The nft drop-in is what nftables.service re-applies at boot; pointing it at
the Go workers makes the #662 cutover survive a reboot. Rollback = 809x→808x.
Live /etc/nftables.d/zz-secubox-toolbox-wg-fanout.nft already updated + dry-run
validated (nft -c -f exit 0).
This commit is contained in:
CyberMind-FR 2026-06-18 22:08:37 +02:00
parent c7d354a153
commit eea4632642
1 changed files with 15 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
packages/secubox-toolbox/nftables.d/secubox-toolbox-wg-fanout.nft
View File

@ -3,7 +3,12 @@
#
# REPLACES the prerouting rules from secubox-toolbox-wg.nft :
# iif wg-toolbox tcp dport 443 dnat ip to 10.99.1.1:8081 (single port)
# with a round-robin numgen mapping to ports 8081..8084.
# with a round-robin numgen mapping to ports 8091..8094.
#
# #662 CUTOVER (2026-06-18): the fanout now targets the Go MITM engine
# (secubox-toolbox-ng-worker@{1..4}, transparent on 10.99.1.1:809%i) instead
# of the Python mitmproxy workers (808%i). Rollback = change 809x → 808x below
# and `nft -f` this file (the Python workers are kept warm for that).
#
# Why numgen inc and not jhash : nftables 1.0.6 (Debian bookworm) doesn't
# support `jhash` in numgen yet (lands in 1.0.7+). `inc` is round-robin
@ -25,19 +30,20 @@ table inet wg-toolbox {
# Phase 9 (#501) — 4-worker round-robin DNAT. numgen returns
# 0..3 ; the map sends each to one of the 4 worker ports on
# 10.99.1.1. Conntrack pins the choice for the whole flow.
# #662: ports are 809x (Go engine), was 808x (Python).
iif "wg-toolbox" tcp dport 443 dnat ip to 10.99.1.1 \
: numgen inc mod 4 map {
0 : 8081,
1 : 8082,
2 : 8083,
3 : 8084
0 : 8091,
1 : 8092,
2 : 8093,
3 : 8094
}
iif "wg-toolbox" tcp dport 80 dnat ip to 10.99.1.1 \
: numgen inc mod 4 map {
0 : 8081,
1 : 8082,
2 : 8083,
3 : 8084
0 : 8091,
1 : 8092,
2 : 8093,
3 : 8094
}
# Phase 7 (#498) — DNS DNAT for legacy peer configs that hand out