ferm.conf

# Drop all IPv6, we don't use or need it
domain ip6 table filter chain (INPUT FORWARD OUTPUT) DROP;

# Reject TCP with an RST and everything else with ICMP
@def &REJECT() = {
    proto tcp REJECT reject-with tcp-reset;
    REJECT reject-with icmp-admin-prohibited;
}

# Challenge boilerplate
# Create IPset and configure netmapping
@def &CHALLENGE($id, $name) = {
    @def $set = "$id$name";
    @hook pre "ipset -N $set iphash";

    table nat chain PREROUTING {
        mod set set $set src @subchain {
            daddr 10.253.179.0/24 NETMAP to "192.168.$id.0/24";

            # do not fall through to no-challenge rules
            ACCEPT;
        }
    }
}

# Internal subnets must not come in from the wire
# the 'mangle' table is applied before the 'nat' table
table mangle chain PREROUTING {
    interface int daddr 192.168.0.0/16 DROP;
}

chain INPUT {
    policy DROP;
    interface lo ACCEPT;
    mod state state (ESTABLISHED RELATED) ACCEPT;

    # XXX: Restrict me
    proto tcp dport ssh ACCEPT;

    # Game web interface
    interface int daddr 10.253.178.1 proto tcp dport http ACCEPT;
}

chain FORWARD {
    policy DROP;
    mod state state (ESTABLISHED RELATED) ACCEPT;
}

@include "/opt/intercensor/challenges/01recordbreaker/ferm.conf";
@include "/opt/intercensor/challenges/02anondelivers/ferm.conf";
@include "/opt/intercensor/challenges/99shutdown/ferm.conf";

# If no challenge is selected, we fall through to these rules (all following
# blocks)
chain INPUT {
    # allow DNS for no-challenge, everything should resolve to game interface
    daddr 192.168.0.1 proto (tcp udp) dport domain ACCEPT;
}

chain (INPUT FORWARD) {
    # REJECT any remaining packets to make it more obvious
    # XXX: use different ICMP codes here to make failure clear
    # and maybe *LOG*
    &REJECT();
}

table nat chain PREROUTING {
    # redirect all HTTP requests to game interface. If someone just goes to any
    # URL in his browser, he will reach the game interface
    proto tcp dport http DNAT to 10.253.178.1;

    # map to no-challenge subnet. We run a DNS server on 192.168.0.1
    daddr 10.253.179.0/24 NETMAP to 192.168.0.0/24;
}
# end of no-challenge rules

# Classic masquerading for outgoing packets
table nat chain POSTROUTING {
    outerface ext MASQUERADE;
}