From d65c4f36739f33c03a91a146d9e03b1c9e9bfcd5 Mon Sep 17 00:00:00 2001
From: Ben Duncan <5178243+benduncan@users.noreply.github.com>
Date: Fri, 4 Sep 2026 13:21:36 -0500
Subject: [PATCH] fix: family-qualify unscoped firewall accepts to IPv4 (#999)

The public, formation and DNS accept rules carried no address family, so
on a node that autoconfigures a global IPv6 from an upstream Router
Advertisement they served the console, predastore S3 gate, AWS gateway
and DNS on that public address with none of the source scoping applied on
IPv4. Qualify them with meta nfproto ipv4 so v6 falls to the default
drop; the scoped rules are already v4-only via ip saddr.
---
 scripts/setup.sh | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/scripts/setup.sh b/scripts/setup.sh
index a0ab7ae61..df4c26eb4 100755
--- a/scripts/setup.sh
+++ b/scripts/setup.sh
@@ -400,21 +400,24 @@ table inet spinifex_filter {
         # gateway, never NATS, so no cluster port needs to face the guests.
         # 443 has no listener yet and is held for the nginx TLS edge, so the
         # rollout does not need a firewall change on every node.
-        tcp dport { 443, 3000, 8443, 9999 } accept
+        # nfproto ipv4: these accepts carry no source scope, so without a family
+        # qualifier they would also serve on any global IPv6 a node autoconfigures
+        # from an upstream RA. The scoped rules are v4-only via `ip saddr` already.
+        meta nfproto ipv4 tcp dport { 443, 3000, 8443, 9999 } accept
 
         # Transiently open to any source, for cluster formation. A node dialling
         # in to join is not a peer yet, so the peer-scoped rule below cannot let
         # it in; `spx admin init` opens the formation port here for the length of
         # the formation window and closes it again afterwards. Normally holds
         # only the sentinel, which no packet can match.
-        tcp dport $spinifex_open_ports accept
+        meta nfproto ipv4 tcp dport $spinifex_open_ports accept
 
         # 53 is open on every node, deliberately: northstar serves public
         # authoritative DNS and binds its advertise address. A node running no
         # public zone answers here too, which is the accepted cost of not
         # templating the policy per node.
-        tcp dport 53 accept
-        udp dport 53 accept
+        meta nfproto ipv4 tcp dport 53 accept
+        meta nfproto ipv4 udp dport 53 accept
 
         # Cluster plane, peer-scoped. On a single-NIC node the planes collapse
         # onto the public address, which is why these are peer addresses rather