0commit e13204569df42d39c100cc2f0cb5bb65276d2cec
1Author: lakefox <mason@lakefox.net>
2Date:   Sun Dec 21 09:40:31 2025 -0700
3
4    Still need hairpin NAT
5
6diff --git a/fla.sh b/fla.sh
7index 4facd5d..8d644f5 100755
8--- a/fla.sh
9+++ b/fla.sh
10@@ -41,8 +41,10 @@ grub-install --target=i386-pc \
11 # 6. minimal grub.cfg
12 mkdir -p "$mnt/boot/grub"
13 cat > "$mnt/boot/grub/grub.cfg" <<'GRUB'
14-set timeout=3
15-menuentry "BusyBox router" {
16+set timeout=1
17+set terminal_input console
18+set terminal_output console
19+menuentry "Spectre Router" {
20     linux  /boot/vmlinuz/vmlinuz-6.12.57+deb13-amd64 root=/dev/ram0 rw i8042.nomux=1 i8042.reset=1 i8042.direct=1 i8042.dumbkbd=1
21     initrd /boot/initramfs.img
22 }
23diff --git a/.init.sh.swp b/modules/.network.sh.swp
24similarity index 66%
25rename from .init.sh.swp
26rename to modules/.network.sh.swp
27index 08f5235..fee65d7 100644
28Binary files a/.init.sh.swp and b/modules/.network.sh.swp differ
29diff --git a/modules/dhcp.sh b/modules/dhcp.sh
30index 1420eaf..2d08da7 100755
31--- a/modules/dhcp.sh
32+++ b/modules/dhcp.sh
33@@ -6,7 +6,7 @@ touch root/var/lib/misc/udhcpd.leases
34 cat << EOF > root/etc/udhcpd.conf
35 # The range of IPs to lease
36 start      192.168.0.2
37-end        192.168.1.254
38+end        192.168.0.254
39 
40 # The interface to listen on
41 interface  eth1
42diff --git a/modules/network.sh b/modules/network.sh
43index 360db70..d266dbf 100755
44--- a/modules/network.sh
45+++ b/modules/network.sh
46@@ -18,6 +18,11 @@ udhcpc -i eth0 -s /usr/share/udhcpc/default.script -n -q -t 5
47 # Give the kernel a second to settle the routing table
48 sleep 2
49 
50+# Get the current public IP from eth0
51+WAN_IP=$(ip -4 addr show eth0 | grep -oP '(?<=inet\s)\d+(\.\d+){3}')
52+
53+echo "Detected WAN IP: $WAN_IP"
54+
55 # --- 3. nftables Firewall (Stateful & Hardened) ---
56 nft flush ruleset
57 nft add table ip filter
58@@ -50,16 +55,25 @@ nft add rule ip filter forward iifname "eth1" oifname "eth1" accept
59 
60 # Forwarding to your Server (.11)
61 nft add rule ip filter forward ip daddr 192.168.0.11 tcp dport 80 limit rate 50/second accept
62-nft add rule ip filter forward ip daddr 192.168.0.11 { tcp, udp } dport 53 limit rate 50/second accept
63+nft add rule ip filter forward ip daddr 192.168.0.11 tcp dport 53 limit rate 50/second accept
64+nft add rule ip filter forward ip daddr 192.168.0.11 udp dport 53 limit rate 50/second accept
65 
66 # --- 3. NAT & PORT FORWARDING ---
67 # Inbound Port Forwards
68 nft add rule ip nat prerouting iifname "eth0" tcp dport 80 dnat to 192.168.0.11
69-nft add rule ip nat prerouting iifname "eth0" { tcp, udp } dport 53 dnat to 192.168.0.11
70+nft add rule ip nat prerouting iifname "eth0" tcp dport 53 dnat to 192.168.0.11
71+nft add rule ip nat prerouting iifname "eth0" udp dport 53 dnat to 192.168.0.11
72 
73 # Hairpin NAT (Internal devices using public IP/Domain)
74 nft add rule ip nat postrouting ip saddr 192.168.0.0/24 ip daddr 192.168.0.11 tcp dport 80 masquerade
75-nft add rule ip nat postrouting ip saddr 192.168.0.0/24 ip daddr 192.168.0.11 { tcp, udp } dport 53 masquerade
76+nft add rule ip nat postrouting ip saddr 192.168.0.0/24 ip daddr 192.168.0.11 tcp dport 53 masquerade
77+nft add rule ip nat postrouting ip saddr 192.168.0.0/24 ip daddr 192.168.0.11 udp dport 53 masquerade
78 
79 # Outbound NAT (Internet for everyone)
80 nft add rule ip nat postrouting oifname "eth0" masquerade
81+
82+# Allow SSH to .11 ONLY if the request comes from the local network
83+nft add rule ip filter forward ip saddr 192.168.0.0/24 ip daddr 192.168.0.11 tcp dport 22 accept
84+
85+# Hairpin NAT Prerouting (Uses variable instead of hard-coded IP)
86+nft add rule ip nat prerouting iifname "eth1" ip daddr $WAN_IP tcp dport 80 dnat to 192.168.0.11