Allow LXC traffic through host firewall

Author: gitcommit90

CHANGELOG.md

@@ -16,6 +16,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   bootstrap. A channel no longer repeatedly creates and cleans up its computer
   after starting `apt` during the guest-network race.
 
+- 1Helm's narrow owned LXC forwarding rules are inserted ahead of host firewall
+  policies such as Docker's `FORWARD=DROP`, allowing resident guests to reach
+  package mirrors without replacing Docker or Tailscale chains.
+
 - The host installer now prepares the same `/var/lib/1helm-lxc/machines` tree
   used by the runtime instead of leaving an obsolete empty `containers` tree.
 

scripts/1helm-lxc-net

@@ -7,6 +7,8 @@ set -euo pipefail
 
 MARKER="/run/1helm-lxc-net-owned"
 RULE_MARKER="/run/1helm-lxc-net-rules-owned"
+INPUT_CHAIN="ONEHELM_LXC_INPUT"
+FORWARD_CHAIN="ONEHELM_LXC_FORWARD"
 DNSMASQ_PID="/run/lxc/dnsmasq.pid"
 DNSMASQ_STATE="/var/lib/1helm-lxc/network"
 DNSMASQ_LEASE="$DNSMASQ_STATE/misc/dnsmasq.lxcbr0.leases"
@@ -42,29 +44,45 @@ start_bridge_dns() {
 install_rules() {
   sysctl -q -w net.ipv4.ip_forward=1 >/dev/null
   if [[ -e "$RULE_MARKER" ]]; then
+    remove_filter_rules
     nft delete table inet onehelm_lxc 2>/dev/null || true
     nft delete table ip onehelm_lxc 2>/dev/null || true
-  elif nft list table inet onehelm_lxc >/dev/null 2>&1 || nft list table ip onehelm_lxc >/dev/null 2>&1; then
+  elif iptables -S "$INPUT_CHAIN" >/dev/null 2>&1 || iptables -S "$FORWARD_CHAIN" >/dev/null 2>&1 \
+    || nft list table inet onehelm_lxc >/dev/null 2>&1 || nft list table ip onehelm_lxc >/dev/null 2>&1; then
     echo "A non-1Helm nftables ruleset already uses the onehelm_lxc name." >&2
     exit 1
   fi
+  # Docker and other host software can set the real FORWARD chain policy to
+  # DROP. A parallel nftables base chain cannot override a later base-chain
+  # drop, so jump to 1Helm's exact owned rules before those host policies.
+  iptables -w -N "$INPUT_CHAIN"
+  iptables -w -A "$INPUT_CHAIN" -i "$BRIDGE" -p udp -m multiport --dports 53,67 -j ACCEPT
+  iptables -w -A "$INPUT_CHAIN" -i "$BRIDGE" -p tcp -m multiport --dports 53,67 -j ACCEPT
+  iptables -w -I INPUT 1 -j "$INPUT_CHAIN"
+  iptables -w -N "$FORWARD_CHAIN"
+  iptables -w -A "$FORWARD_CHAIN" -i "$BRIDGE" -j ACCEPT
+  iptables -w -A "$FORWARD_CHAIN" -o "$BRIDGE" -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
+  iptables -w -I FORWARD 1 -j "$FORWARD_CHAIN"
   nft -f - <<'EOF'
-add table inet onehelm_lxc
-add chain inet onehelm_lxc input { type filter hook input priority -10; policy accept; }
-add rule inet onehelm_lxc input iifname "lxcbr0" udp dport { 53, 67 } accept
-add rule inet onehelm_lxc input iifname "lxcbr0" tcp dport { 53, 67 } accept
-add chain inet onehelm_lxc forward { type filter hook forward priority -10; policy accept; }
-add rule inet onehelm_lxc forward iifname "lxcbr0" accept
-add rule inet onehelm_lxc forward oifname "lxcbr0" ct state established,related accept
 add table ip onehelm_lxc
 add chain ip onehelm_lxc postrouting { type nat hook postrouting priority srcnat; policy accept; }
 add rule ip onehelm_lxc postrouting ip saddr 10.0.3.0/24 ip daddr != 10.0.3.0/24 masquerade
 EOF
   install -m 0600 /dev/null "$RULE_MARKER"
 }
 
+remove_filter_rules() {
+  while iptables -w -C INPUT -j "$INPUT_CHAIN" >/dev/null 2>&1; do iptables -w -D INPUT -j "$INPUT_CHAIN"; done
+  while iptables -w -C FORWARD -j "$FORWARD_CHAIN" >/dev/null 2>&1; do iptables -w -D FORWARD -j "$FORWARD_CHAIN"; done
+  iptables -w -F "$INPUT_CHAIN" 2>/dev/null || true
+  iptables -w -X "$INPUT_CHAIN" 2>/dev/null || true
+  iptables -w -F "$FORWARD_CHAIN" 2>/dev/null || true
+  iptables -w -X "$FORWARD_CHAIN" 2>/dev/null || true
+}
+
 remove_rules() {
   if [[ -e "$RULE_MARKER" ]]; then
+    remove_filter_rules
     nft delete table inet onehelm_lxc 2>/dev/null || true
     nft delete table ip onehelm_lxc 2>/dev/null || true
     rm -f -- "$RULE_MARKER"
@@ -105,14 +123,12 @@ lease_state_writable() {
 
 rules_healthy() {
   [[ -e "$RULE_MARKER" ]] || return 1
-  nft list chain inet onehelm_lxc input 2>/dev/null \
-    | grep -Eq 'iifname "lxcbr0" udp dport \{ 53, 67 \} accept' || return 1
-  nft list chain inet onehelm_lxc input 2>/dev/null \
-    | grep -Eq 'iifname "lxcbr0" tcp dport \{ 53, 67 \} accept' || return 1
-  nft list chain inet onehelm_lxc forward 2>/dev/null \
-    | grep -Fq 'iifname "lxcbr0" accept' || return 1
-  nft list chain inet onehelm_lxc forward 2>/dev/null \
-    | grep -Eq 'oifname "lxcbr0" ct state (established,related|related,established) accept' || return 1
+  [[ "$(iptables -S INPUT | sed -n '2p')" == "-A INPUT -j $INPUT_CHAIN" ]] || return 1
+  [[ "$(iptables -S FORWARD | sed -n '2p')" == "-A FORWARD -j $FORWARD_CHAIN" ]] || return 1
+  iptables -S "$INPUT_CHAIN" 2>/dev/null | grep -Fxq -- "-A $INPUT_CHAIN -i $BRIDGE -p udp -m multiport --dports 53,67 -j ACCEPT" || return 1
+  iptables -S "$INPUT_CHAIN" 2>/dev/null | grep -Fxq -- "-A $INPUT_CHAIN -i $BRIDGE -p tcp -m multiport --dports 53,67 -j ACCEPT" || return 1
+  iptables -S "$FORWARD_CHAIN" 2>/dev/null | grep -Fxq -- "-A $FORWARD_CHAIN -i $BRIDGE -j ACCEPT" || return 1
+  iptables -S "$FORWARD_CHAIN" 2>/dev/null | grep -Fxq -- "-A $FORWARD_CHAIN -o $BRIDGE -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT" || return 1
   nft list chain ip onehelm_lxc postrouting 2>/dev/null \
     | grep -Eq 'ip saddr 10\.0\.3\.0/24 ip daddr != 10\.0\.3\.0/24 masquerade' || return 1
 }

scripts/1helm-lxc-runtime

@@ -89,7 +89,9 @@ wait_for_guest_network() {
       '
       if lxc-attach -P "$LXC_PATH" -n "$name" --clear-env -- /bin/sh -c '
         getent ahostsv4 archive.ubuntu.com >/dev/null \
-          && getent ahostsv4 security.ubuntu.com >/dev/null
+          && getent ahostsv4 security.ubuntu.com >/dev/null \
+          && curl -4 -fsS --connect-timeout 2 --max-time 5 \
+            http://archive.ubuntu.com/ubuntu/dists/noble/InRelease >/dev/null
       ' >/dev/null 2>&1; then
         return
       fi
@@ -249,8 +251,8 @@ case "$operation" in
     wait_for_guest_network "$name"
     lxc-attach -P "$LXC_PATH" -n "$name" --clear-env -- /bin/sh -eu -c '
       export DEBIAN_FRONTEND=noninteractive
-      apt-get update -o APT::Update::Error-Mode=any
-      apt-get install -y --no-install-recommends bash build-essential ca-certificates coreutils cron curl dbus file findutils git gzip iproute2 iputils-ping jq less locales man-db nano openssh-client procps python3 python3-pip rsync sudo systemd systemd-sysv tar tzdata unzip vim-tiny wget xz-utils zip
+      apt-get update -o Acquire::ForceIPv4=true -o APT::Update::Error-Mode=any
+      apt-get install -y -o Acquire::ForceIPv4=true --no-install-recommends bash build-essential ca-certificates coreutils cron curl dbus file findutils git gzip iproute2 iputils-ping jq less locales man-db nano openssh-client procps python3 python3-pip rsync sudo systemd systemd-sysv tar tzdata unzip vim-tiny wget xz-utils zip
       apt-get clean
       rm -rf /var/lib/apt/lists/*
       existing_group="$(getent group 1000 | cut -d: -f1 || true)"

test/site.mjs

@@ -200,16 +200,17 @@ test("installer assets are explicit and syntax-valid", () => {
   assert.match(lxcHelper, /ownership marker does not match/);
   assert.match(lxcHelper, /cleanup_incomplete_create[\s\S]*rm -rf -- "\$LXC_PATH\/\$name"[\s\S]*created=1[\s\S]*lxc-create/, "a failed create removes only its validated partial container directory");
   assert.match(lxcHelper, /wait_for_guest_network[\s\S]*10\\\.0\\\.3\\\.[\s\S]*via 10\\\.0\\\.3\\\.1 dev eth0/, "fresh LXC provisioning waits for its DHCP address and default route");
-  assert.match(lxcHelper, /archive\.ubuntu\.com[\s\S]*security\.ubuntu\.com/, "fresh LXC provisioning proves DNS before package bootstrap");
-  assert.match(lxcHelper, /start "\$name"[\s\S]*wait_for_guest_network "\$name"[\s\S]*apt-get update -o APT::Update::Error-Mode=any/, "package bootstrap begins only after bounded guest-network readiness");
+  assert.match(lxcHelper, /archive\.ubuntu\.com[\s\S]*security\.ubuntu\.com[\s\S]*curl -4[\s\S]*InRelease/, "fresh LXC provisioning proves DNS and outbound IPv4 HTTP before package bootstrap");
+  assert.match(lxcHelper, /start "\$name"[\s\S]*wait_for_guest_network "\$name"[\s\S]*apt-get update -o Acquire::ForceIPv4=true -o APT::Update::Error-Mode=any/, "package bootstrap begins only after bounded guest-network readiness");
   assert.match(lxcHelper, /cpuset\.cpus\.effective/, "LXC CPU limits are selected from the service's actually delegated host CPUs");
   assert.match(lxcHelper, /cpu_count/, "LXC inspection counts noncontiguous delegated CPU lists correctly");
   assert.match(lxcNetwork, /1helm-lxc-net-owned/, "the bridge wrapper stops only a bridge it started");
-  assert.match(lxcNetwork, /1helm-lxc-net-rules-owned[\s\S]*table ip onehelm_lxc[\s\S]*masquerade/, "an adopted bridge receives a separately owned, removable outbound NAT contract");
+  assert.match(lxcNetwork, /1helm-lxc-net-rules-owned[\s\S]*ONEHELM_LXC_INPUT[\s\S]*ONEHELM_LXC_FORWARD[\s\S]*iptables -w -I INPUT 1[\s\S]*iptables -w -I FORWARD 1[\s\S]*table ip onehelm_lxc[\s\S]*masquerade/, "an adopted bridge receives owned filter jumps ahead of host drop policies plus removable outbound NAT");
   assert.match(lxcNetwork, /DNSMASQ_LEASE="\$DNSMASQ_STATE\/misc\/dnsmasq\.lxcbr0\.leases"[\s\S]*lease_state_writable[\s\S]*mktemp[\s\S]*bridge_dns_healthy/, "runtime health proves the exact private dnsmasq lease tree is writable from its current mount namespace");
   assert.match(lxcNetwork, /start_bridge_dns[\s\S]*dnsmasq[\s\S]*--dhcp-leasefile="\$DNSMASQ_LEASE"/, "1Helm starts its private DHCP server directly instead of inheriting the distro helper's system-wide lease path");
   assert.match(lxcNetwork, /--dhcp-range[\s\S]*10\.0\.3\.2,10\.0\.3\.254[\s\S]*--dhcp-lease-max=253[\s\S]*--dhcp-authoritative[\s\S]*--dhcp-leasefile=\$DNSMASQ_LEASE/, "runtime health verifies the exact DHCP and private lease-file process contract");
-  assert.match(lxcNetwork, /rules_healthy[\s\S]*nft list chain inet onehelm_lxc input[\s\S]*nft list chain inet onehelm_lxc forward[\s\S]*nft list chain ip onehelm_lxc postrouting[\s\S]*10\\\.0\\\.3\\\.0\/24[\s\S]*masquerade/, "runtime health verifies the exact DNS, DHCP, forwarding, and outbound NAT rules instead of accepting table names alone");
+  assert.match(lxcNetwork, /rules_healthy[\s\S]*iptables -S INPUT[\s\S]*iptables -S FORWARD[\s\S]*nft list chain ip onehelm_lxc postrouting[\s\S]*10\\\.0\\\.3\\\.0\/24[\s\S]*masquerade/, "runtime health verifies first-position host filter jumps and exact outbound NAT instead of accepting an ineffective parallel base chain");
+  assert.match(lxcNetwork, /FORWARD_CHAIN="ONEHELM_LXC_FORWARD"[\s\S]*-A "\$FORWARD_CHAIN" -i "\$BRIDGE" -j ACCEPT[\s\S]*-A "\$FORWARD_CHAIN" -o "\$BRIDGE"/, "the owned forwarding chain accepts guest egress and only established return traffic");
   assert.match(lxcNetwork, /BRIDGE_CIDR="10\.0\.3\.1\/24"[\s\S]*bridge_dns_healthy[\s\S]*state UP[\s\S]*DNSMASQ_PID[\s\S]*--interface=lxcbr0[\s\S]*network_healthy/, "runtime health requires an up/addressed bridge and its exact dnsmasq process");
   assert.match(lxcNetwork, /bridge_dns_healthy[\s\S]*ensure_rules[\s\S]*network_healthy/, "a healthy bridge can restore only its owned firewall rules without disrupting containers");
   assert.match(lxcNetwork, /"\$LXC_NET" stop force[\s\S]*start_bridge_dns[\s\S]*network_healthy/, "a dead private bridge/DNS stack is rebuilt with 1Helm-owned DHCP state and reverified instead of adopted by interface name");