chore: update submodule refs, clean up plans/evidence, update .gitignore

2026-06-07 23:53:15 +07:00
parent 281ac48d28
commit cbacfea7f2
43 changed files with 139 additions and 2 deletions
@@ -0,0 +1,19 @@
+table ip nexusguard {
+	chain forward {
+		type filter hook forward priority filter; policy accept;
+		ct state established,related accept comment "fwd_estab"
+		ip saddr 10.172.21.2 ip daddr 10.172.21.0/24 accept comment "peer_gogo2"
+		ip saddr 10.172.21.3 ip daddr 10.172.21.0/24 accept comment "peer_gogo3"
+		ip saddr 10.172.21.0/24 drop comment "wg_isolation_default"
+	}
+}
+
+# Rule counts:
+#   total = 4
+#   peer_ = 2 (peer_gogo2, peer_gogo3)
+#   fwd_estab = 1
+#   wg_isolation_default = 1
+#   duplicates: NONE (verified via `sort | uniq -c`)
+#
+# Rule order: CORRECT (fwd_estab first for fast-path, wg_isolation last for default drop)
+# Persistence: STABLE (no process re-adding rules; verified across 30s window)