array-firewall/proxmox-host-setup.sh at main · advancedresearcharray/array-firewall · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
#!/usr/bin/env bash
# Provision array-firewall LXC on Proxmox (run on hypervisor host)
# Uses privileged LXC for nftables/netfilter and low-level networking.
set -euo pipefail

: "${ARRAY_FW_CTID:?Set ARRAY_FW_CTID}"
CTID="${ARRAY_FW_CTID}"
VM_IP="${ARRAY_FW_IP:-192.0.2.241}"
LAB_CIDR="${ARRAY_FW_LAB_IP:-198.51.100.1/24}"
GW="${ARRAY_FW_GW:-192.0.2.1}"
SSH_PUB="${ARRAY_FW_SSH_PUB:-/root/.ssh/id_rsa.pub}"
TEMPLATE="${ARRAY_FW_TEMPLATE:-/var/lib/vz/template/cache/debian-12-standard_12.12-1_amd64.tar.zst}"

if [[ ! -f "$SSH_PUB" ]]; then
  echo "Missing SSH public key: $SSH_PUB" >&2
  exit 1
fi

# vmbr1 → nic2 (Intel 1G — Firewalla port 1 today; use nic1 after recabling to Aquantia)
if ! grep -q '^auto vmbr1' /etc/network/interfaces; then
  cat >> /etc/network/interfaces <<'EOF'

auto vmbr1
iface vmbr1 inet manual
	mtu 1500
	bridge-ports nic2
	bridge-stp off
	bridge-fd 0
EOF
  echo "[array-firewall] Added vmbr1 → nic2 (Firewalla port 1)"
fi

cat > /etc/sysctl.d/99-array-firewall-host.conf <<'EOF'
net.ipv4.ip_forward=1
net.ipv6.conf.all.forwarding=1
EOF
sysctl --system >/dev/null 2>&1 || true
ifreload -a 2>/dev/null || true
ip link set nic2 up 2>/dev/null || true
ip link set vmbr1 up 2>/dev/null || true
ip link set nic1 up 2>/dev/null || true

if [[ ! -f "$TEMPLATE" ]]; then
  echo "Missing template: $TEMPLATE" >&2
  exit 1
fi

if pct status "$CTID" &>/dev/null; then
  echo "[array-firewall] CT $CTID already exists"
else
  pct create "$CTID" "$TEMPLATE" \
    --hostname array-firewall \
    --memory 1024 \
    --swap 512 \
    --cores 2 \
    --rootfs local-lvm:16 \
    --ostype debian \
    --features nesting=1,keyctl=1 \
    --unprivileged 0 \
    --onboot 1 \
    --nameserver "$GW" \
    --searchdomain array.local \
    --net0 "name=eth0,bridge=vmbr0,gw=${GW},ip=${VM_IP}/24,type=veth" \
    --net1 "name=eth1,bridge=vmbr1,ip=${LAB_CIDR},type=veth" \
    --ssh-public-keys "$SSH_PUB"

  echo "[array-firewall] Created CT $CTID"
fi

pct start "$CTID" 2>/dev/null || true
sleep 3

pct exec "$CTID" -- bash -s -- "$VM_IP" <<'INNER'
set -euo pipefail
VM_IP="$1"
export DEBIAN_FRONTEND=noninteractive
apt-get update -qq
apt-get install -y -qq nftables iproute2 conntrack tcpdump curl ca-certificates git vim

cat > /etc/sysctl.d/99-array-firewall.conf <<EOF
net.ipv4.ip_forward=1
net.ipv6.conf.all.forwarding=1
EOF

cat > /etc/nftables.conf <<'NFT'
#!/usr/sbin/nft -f
flush ruleset
table inet filter {
  chain input {
    type filter hook input priority filter; policy drop;
    iif "lo" accept
    ct state established,related accept
    ip saddr 192.0.2.0/24 tcp dport { 22, 8098 } accept
    ip saddr 192.0.2.0/24 icmp type echo-request accept
    ip saddr 198.51.100.0/24 icmp type echo-request accept
  }
  chain forward {
    type filter hook forward priority filter; policy drop;
  }
  chain output {
    type filter hook output priority filter; policy accept;
  }
}
NFT

mkdir -p /etc/array-firewall
cat > /etc/array-firewall/README <<EOF
array-firewall — Proxmox LXC (CT ${CTID})
eth0 (${VM_IP}): LAN management + API
eth1 (lab): secondary NIC via lab bridge — no WAN yet
EOF

sysctl -p /etc/sysctl.d/99-array-firewall.conf 2>/dev/null || true
nft -f /etc/nftables.conf
systemctl enable nftables
systemctl restart nftables
INNER

echo "[array-firewall] Verifying..."
pct exec "$CTID" -- bash -c 'hostname; ip -br addr; nft list chain inet filter input; systemctl is-active nftables'

echo ""
echo "array-firewall ready:"
echo "  Container: CT${CTID}"
echo "  SSH:       root@${VM_IP}"
echo "  Lab NIC:   eth1 ${LAB_CIDR}"