feat(device-plane): accept core edge transport ADR

2026-08-10 16:40:48 +03:00
parent 07224c6f0d
commit bf0bc50abb
27 changed files with 5034 additions and 26 deletions
@@ -0,0 +1,16 @@
+PasswordAuthentication no
+KbdInteractiveAuthentication no
+PermitRootLogin prohibit-password
+PubkeyAuthentication yes
+AuthenticationMethods publickey
+X11Forwarding no
+AllowAgentForwarding no
+AllowTcpForwarding no
+GatewayPorts no
+PermitTunnel no
+PermitUserEnvironment no
+MaxAuthTries 3
+LoginGraceTime 20
+ClientAliveInterval 60
+ClientAliveCountMax 3
+UseDNS no
@@ -0,0 +1,23 @@
+Host device-backhaul-target
+  HostName 100.109.216.21
+  Port 2222
+  User device-backhaul
+  AddressFamily inet
+  IdentityFile /var/lib/nodedc-b2-vps/trust/backhaul_ed25519
+  IdentitiesOnly yes
+  PreferredAuthentications publickey
+  PasswordAuthentication no
+  KbdInteractiveAuthentication no
+  StrictHostKeyChecking yes
+  UserKnownHostsFile /var/lib/nodedc-b2-vps/trust/backhaul_known_hosts
+  GlobalKnownHostsFile /dev/null
+  ProxyCommand /usr/bin/nc -X 5 -x 127.0.0.1:1055 %h %p
+  LocalForward 127.0.0.1:19921 127.0.0.1:9921
+  ExitOnForwardFailure yes
+  ServerAliveInterval 30
+  ServerAliveCountMax 3
+  TCPKeepAlive yes
+  ClearAllForwardings no
+  RequestTTY no
+  SessionType none
+  LogLevel VERBOSE
@@ -0,0 +1,22 @@
+flush ruleset
+
+table inet nodedc_b2_vps {
+  chain input {
+    type filter hook input priority -10; policy drop;
+
+    iifname "lo" accept
+    ct state invalid drop
+    ct state established,related accept
+    ip protocol icmp accept
+    ip6 nexthdr ipv6-icmp accept
+    tcp dport 22 ct state new limit rate 30/minute burst 60 packets accept
+  }
+
+  chain forward {
+    type filter hook forward priority -10; policy drop;
+  }
+
+  chain output {
+    type filter hook output priority -10; policy accept;
+  }
+}
@@ -0,0 +1,24 @@
+flush ruleset
+
+table inet nodedc_b2_vps {
+  chain input {
+    type filter hook input priority -10; policy drop;
+
+    iifname "lo" accept
+    ct state invalid drop
+    ct state established,related accept
+    ip protocol icmp accept
+    ip6 nexthdr ipv6-icmp accept
+    tcp dport 22 ct state new limit rate 30/minute burst 60 packets accept
+    tcp dport 9921 ct state new limit rate over 300/second drop
+    tcp dport 9921 accept
+  }
+
+  chain forward {
+    type filter hook forward priority -10; policy drop;
+  }
+
+  chain output {
+    type filter hook output priority -10; policy accept;
+  }
+}