Salt Phase 3: nftables firewall (default deny inbound) #5

New issue

Closed

opened 2026-02-27 20:41:49 +00:00 by forgejo_admin · 0 comments

forgejo_admin commented

2026-02-27 20:41:49 +00:00

Owner

Plan

plan-2026-02-26-salt-host-management — Phase 3

Repo

pal-e-platform — Forgejo (private)

User Story

As a platform operator
I need a Salt-managed nftables firewall with default deny inbound
So that the host is hardened against unauthorized access while preserving Tailscale, k3s, and LAN SSH connectivity

Acceptance Criteria

When I run salt-call state.apply firewall test=True
Then it shows the expected nftables changes (install, config, enable service)

When I run nft list ruleset after applying
Then the rules match the pillar data (default deny inbound, allow tailscale0/lo/flannel/k8s/LAN SSH/established+related)

When the firewall is active
Then Tailscale connectivity is uninterrupted (outbound never restricted, tailscale0 fully allowed)

Additional Information

See issue-pal-e-platform-salt-phase-3-nftables in pal-e-docs for full details.

Safety constraint: Tailscale is the remote access safety net. Outbound must NEVER be restricted. tailscale0 must be fully allowed. Operator applies manually with revert timer.

Checklist

PR opened
salt-call state.apply firewall test=True succeeds
Rendered nftables.conf is valid
top.sls files updated

plan-2026-02-26-salt-host-management — parent plan
plan-2026-02-26-network-security-hardening — depends on this

### Plan `plan-2026-02-26-salt-host-management` — Phase 3 ### Repo `pal-e-platform` — Forgejo (private) ### User Story As a platform operator I need a Salt-managed nftables firewall with default deny inbound So that the host is hardened against unauthorized access while preserving Tailscale, k3s, and LAN SSH connectivity ### Acceptance Criteria When I run `salt-call state.apply firewall test=True` Then it shows the expected nftables changes (install, config, enable service) When I run `nft list ruleset` after applying Then the rules match the pillar data (default deny inbound, allow tailscale0/lo/flannel/k8s/LAN SSH/established+related) When the firewall is active Then Tailscale connectivity is uninterrupted (outbound never restricted, tailscale0 fully allowed) ### Additional Information See `issue-pal-e-platform-salt-phase-3-nftables` in pal-e-docs for full details. **Safety constraint:** Tailscale is the remote access safety net. Outbound must NEVER be restricted. `tailscale0` must be fully allowed. Operator applies manually with revert timer. ### Checklist - [ ] PR opened - [ ] `salt-call state.apply firewall test=True` succeeds - [ ] Rendered nftables.conf is valid - [ ] top.sls files updated ### Related - `plan-2026-02-26-salt-host-management` — parent plan - `plan-2026-02-26-network-security-hardening` — depends on this