Automatic firewall rule creation

[WGH-]

Setting up firewall rules is annoying. It would be much better if phantun created them automatically.

I think researching how docker and incus (lxd) handle firewall integration would be a good starting point.

[WGH-]

Personally, I've been using small scripts that create named nft tables with some success, but that's probably not the best solution (due to lack of integration with common firewall management systems)

#!/bin/bash

set -euo pipefail

IFNAME=$1
DPORT=$2

nft -f - <<EOT
table inet phantun-$IFNAME {
    chain prerouting {
        type nat hook prerouting priority dstnat; policy accept;
        iifname != $IFNAME tcp dport $DPORT dnat ip to 192.168.201.2;
        iifname != $IFNAME tcp dport $DPORT dnat ip6 to fcc9::2;
    };
}
EOT

#!/bin/bash

set -euo pipefail

IFNAME=$1

nft -f - <<EOT
table inet phantun-$IFNAME {
    chain postrouting {
        type nat hook postrouting priority srcnat; policy accept;
        iifname $IFNAME masquerade;
    };
}
EOT

#!/bin/bash

set -euo pipefail

IFNAME=$1

nft -f - <<EOT
delete table inet phantun-$IFNAME;
EOT