[HIGH] Mesh WireGuard interface trusted by firewall with no restrictions #21

New issue

Open

opened 2026-05-05 15:44:28 -05:00 by pjennings · 0 comments

pjennings commented

2026-05-05 15:44:28 -05:00

Owner

Labels: area:security, area:network, priority:high, type:enhancement

Description

In modules/profiles/meshNetwork/default.nix line 146:
networking.firewall.trustedInterfaces = [ meshInterface ];

This marks the WireGuard mesh interface as fully trusted, meaning ALL traffic from the mesh is implicitly allowed through the firewall without filtering.

Combined with Docker bridge routing through the mesh (lines 216-238), all Docker container traffic is also implicitly trusted.

Impact

A compromised container on ANY host can access services on ALL other mesh hosts without firewall restrictions. There is no defense-in-depth against lateral movement.

Recommended Fix

Remove trustedInterfaces for the mesh interface
Explicitly allow only required ports/protocols between specific mesh nodes
Use the existing allowlist module to create granular inter-node rules
Separate Docker bridge traffic from mesh traffic with distinct firewall rules

**Labels:** area:security, area:network, priority:high, type:enhancement ## Description In modules/profiles/meshNetwork/default.nix line 146: networking.firewall.trustedInterfaces = [ meshInterface ]; This marks the WireGuard mesh interface as fully trusted, meaning ALL traffic from the mesh is implicitly allowed through the firewall without filtering. Combined with Docker bridge routing through the mesh (lines 216-238), all Docker container traffic is also implicitly trusted. ## Impact A compromised container on ANY host can access services on ALL other mesh hosts without firewall restrictions. There is no defense-in-depth against lateral movement. ## Recommended Fix 1. Remove trustedInterfaces for the mesh interface 2. Explicitly allow only required ports/protocols between specific mesh nodes 3. Use the existing allowlist module to create granular inter-node rules 4. Separate Docker bridge traffic from mesh traffic with distinct firewall rules