From 81801cfd84417631e5729b16e28b601c4360058d Mon Sep 17 00:00:00 2001
From: Arsalan Bashir <a@livedocs.com>
Date: Fri, 26 Jun 2026 03:13:00 -0400
Subject: [PATCH] Fix egress DNS deployment firewall

---
 deploy/install.sh               | 8 ++++++++
 deploy/nftables/sandbox-nat.nft | 2 ++
 deploy/provision-node.sh        | 4 +++-
 3 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/deploy/install.sh b/deploy/install.sh
index b26925a..1a09e9c 100755
--- a/deploy/install.sh
+++ b/deploy/install.sh
@@ -150,6 +150,8 @@ if [[ -f "$(dirname "$0")/nftables/sandbox-nat.nft" ]]; then
   install -m 0644 "$(dirname "$0")/nftables/sandbox-nat.nft" /etc/nftables.d/sandbox-nat.nft
 else
   cat > /etc/nftables.d/sandbox-nat.nft <<'NFT'
+destroy table inet sandboxd
+
 table inet sandboxd {
     define SANDBOX_NET = 10.200.0.0/16
     define HOST_DNS = 10.200.0.1
@@ -187,6 +189,12 @@ nft -f /etc/nftables.d/sandbox-nat.nft 2>/dev/null || warn "nft apply deferred u
 sysctl -qw net.ipv4.ip_forward=1
 echo 'net.ipv4.ip_forward=1' >/etc/sysctl.d/99-workdir.conf
 
+if command -v ufw >/dev/null 2>&1; then
+  ufw allow in on wdbr0 to 10.200.0.1 port 53 proto udp >/dev/null 2>&1 || true
+  ufw allow in on wdbr0 to 10.200.0.1 port 53 proto tcp >/dev/null 2>&1 || true
+  ufw reload >/dev/null 2>&1 || true
+fi
+
 # ---------------------------------------------------------------------------
 # 6. Config + systemd unit
 # ---------------------------------------------------------------------------
diff --git a/deploy/nftables/sandbox-nat.nft b/deploy/nftables/sandbox-nat.nft
index a3b1ef2..097ae2e 100644
--- a/deploy/nftables/sandbox-nat.nft
+++ b/deploy/nftables/sandbox-nat.nft
@@ -8,6 +8,8 @@
 # Apply with:  nft -f /etc/nftables.d/sandbox-nat.nft
 # Persist via /etc/nftables.conf `include "/etc/nftables.d/*.nft"`.
 
+destroy table inet sandboxd
+
 table inet sandboxd {
     # Sandboxes live on this private supernet; one /30 (or tap) per microVM.
     define SANDBOX_NET = 10.200.0.0/16
diff --git a/deploy/provision-node.sh b/deploy/provision-node.sh
index 7abb0b3..9e0b102 100755
--- a/deploy/provision-node.sh
+++ b/deploy/provision-node.sh
@@ -149,10 +149,12 @@ systemctl enable --now workdir-net >/dev/null 2>&1
 if command -v ufw >/dev/null 2>&1; then
   sed -i 's/^DEFAULT_FORWARD_POLICY=.*/DEFAULT_FORWARD_POLICY="ACCEPT"/' /etc/default/ufw
   ufw allow 22/tcp >/dev/null 2>&1 || true
+  ufw allow in on ${BRIDGE} to 10.200.0.1 port 53 proto udp >/dev/null 2>&1 || true
+  ufw allow in on ${BRIDGE} to 10.200.0.1 port 53 proto tcp >/dev/null 2>&1 || true
   yes | ufw enable >/dev/null 2>&1 || true
   ufw reload >/dev/null 2>&1 || true
 fi
-log "  uplink=$UPLINK, forwarding on, ufw routes allowed"
+log "  uplink=$UPLINK, forwarding on, controlled DNS allowed"
 
 # --- 5. build the daemon ---------------------------------------------------
 if ! command -v cargo >/dev/null 2>&1; then