CustomOS3.1 OBSIDIAN
nftables · two profiles
Default: inbound drop, no exposed services; outbound accept so apt and the browser work. Opt-in: tunnel-only egress (kill switch), armed only when wg0/tun0 exists. Fail-closed: a fallback table loads if the main ruleset fails.
Rules of the opt-in kill-switch profile (sample hit counts):
| Action | Dir | Proto | Port | Source → destination | Hits |
|---|---|---|---|---|---|
| PASS | out | udp | 51820 | wg0 → VPN tunnel (if configured) | 22.7k |
| PASS | out | tcp | 853 | → encrypted DNS (DoT) | 9.1k |
| PASS | any | any | — | lo (loopback) | — |
| PASS | in/out | any | — | wg0 (inside the tunnel) | 48.2k |
| BLOCK | in | any | * | * → host | 1.2k |
| BLOCK | out | any | * | outside the tunnel (kill switch) | 340 |