fix(router): publishing the panel on the uplink only opened half the path

Reported from the box: with both uplink toggles on, SSH answered from the
WAN and the panel did not.

Opening a port in INPUT is only half of it. SSH is a host service and is
delivered locally, so it hits INPUT and the allow rule worked. The panel is
an nginx container with published ports: a request to the box's address is
DNAT'd and then FORWARDED to the container, never reaching INPUT, and the
forward policy is drop. The LAN side already had a `ct status dnat` rule
for exactly this reason — the WAN side, added later, did not.

Worse than a missing feature: the operator turns the toggle on precisely so
they can reach the panel after the switch, then cannot, and so cannot press
confirm — the watchdog reverts a router that was working. That is what
happened.

Scoped to `ct status dnat` and the allowed ports rather than a blanket
accept, so it publishes what was asked for and not every other container
port that happens to be mapped.

Verified on hardware: panel and SSH both answer from the uplink while
router mode is up, with the LAN bridged across a wired port and the radio.

Author: DaveBugg

backend/app/core/nftables.py

@@ -552,6 +552,31 @@ async def apply_router_nat(
     ]
     wan_service_rules = "\n".join(rules)
 
+    # The same ports again, in FORWARD — because opening them in INPUT is only
+    # half the story. Services on the host (SSH) are delivered locally and hit
+    # INPUT. The panel is an nginx container with published ports, so a request
+    # to this box's address is DNAT'd and then FORWARDED to the container: it
+    # never reaches INPUT at all, and the forward policy is drop.
+    #
+    # Observed exactly that: with both toggles on, SSH answered from the uplink
+    # and the panel did not.
+    #
+    # Scoped to `ct status dnat` AND the allowed ports, so this admits the
+    # services the operator published and not every other container port that
+    # happens to be mapped.
+    fwd = []
+    if tcp_ports:
+        fwd.append(
+            f'        iifname "{wan}" ct status dnat tcp dport '
+            f'{{ {", ".join(map(str, tcp_ports))} }} accept'
+        )
+    if udp_ports:
+        fwd.append(
+            f'        iifname "{wan}" ct status dnat udp dport '
+            f'{{ {", ".join(map(str, udp_ports))} }} accept'
+        )
+    wan_published_rules = ("\n" + "\n".join(fwd)) if fwd else ""
+
     # One transaction, not two. `delete table` followed by a separate load
     # meant a script that failed to parse left NO ruleset behind — the box
     # ends up with neither the old firewall nor the new one. Declaring the
@@ -621,7 +646,7 @@ async def apply_router_nat(
         # first apply cuts every LAN device off the panel, which also means
         # nobody can press the confirm button and the watchdog reverts a
         # working router purely because we blocked the way to its own UI.
-        iifname "{lan}" ct status dnat accept
+        iifname "{lan}" ct status dnat accept{wan_published_rules}
         # Container-to-container (the reverse proxy reaching the SPA) once
         # bridge-nf-call-iptables puts bridged traffic through this hook.
         iifname "br-*" oifname "br-*" accept

backend/tests/test_router_mode.py

@@ -2357,3 +2357,57 @@ def _async(value):
     async def _fn(*a, **k):
         return value
     return _fn
+
+
+class TestPublishingThePanelOnTheUplink:
+    """Opening a port in INPUT is only half the story. Services on the host —
+    SSH — are delivered locally and hit INPUT. The panel is an nginx container
+    with published ports, so a request to the box's address is DNAT'd and then
+    FORWARDED to the container, never reaching INPUT at all, and the forward
+    policy is drop. Observed on hardware: with both toggles on, SSH answered
+    from the uplink and the panel did not."""
+
+    def _chains(self, **kw):
+        import asyncio
+        from app.core import nftables as nft
+        cap = {}
+
+        async def fake(script):
+            cap["s"] = script
+            return True
+
+        original, nft._nft = nft._nft, fake
+        try:
+            asyncio.run(nft.apply_router_nat("eth0", "br-lan", **kw))
+        finally:
+            nft._nft = original
+        s = cap["s"]
+        return (s.split("chain input")[1].split("chain forward")[0],
+                s.split("chain forward")[1].split("chain ")[0])
+
+    def test_published_ports_are_allowed_in_forward_too(self):
+        _, fwd = self._chains(wan_allow_tcp=[22, 80, 443])
+        rule = [ln.strip() for ln in fwd.splitlines()
+                if "ct status dnat" in ln and "eth0" in ln]
+        assert len(rule) == 1
+        assert "tcp dport { 22, 80, 443 }" in rule[0]
+
+    def test_the_forward_allowance_is_scoped_to_the_published_ports(self):
+        """Not a blanket `ct status dnat accept` on the uplink: that would
+        expose every other container port that happens to be mapped."""
+        _, fwd = self._chains(wan_allow_tcp=[80])
+        rule = next(ln.strip() for ln in fwd.splitlines()
+                    if "ct status dnat" in ln and "eth0" in ln)
+        assert "dport" in rule
+        assert rule != 'iifname "eth0" ct status dnat accept'
+
+    def test_nothing_is_published_when_no_ports_are_opened(self):
+        _, fwd = self._chains()
+        assert not [ln for ln in fwd.splitlines()
+                    if "ct status dnat" in ln and "eth0" in ln]
+
+    def test_udp_ports_get_the_same_treatment(self):
+        _, fwd = self._chains(wan_allow_udp=[51820])
+        rule = [ln.strip() for ln in fwd.splitlines()
+                if "ct status dnat" in ln and "udp dport" in ln]
+        assert len(rule) == 1 and "51820" in rule[0]