Default profile: inbound deny · outbound usable
Inbound: drop, no exposed services (always) · Outbound: accept out of the box (so apt and the browser work) · tunnel-only egress kill switch available as an OPT-IN profile, armed only when wg0/tun0 is detected · antispoof · fail-closed (fallback table if the main ruleset fails to load)
nftables ACTIVE
Active rules (nftables) — view of the opt-in kill-switch profile
| Action | Dir | Proto | Port | Source → Destination | Hits |
|---|---|---|---|---|---|
| PASS | out | udp | 51820 | wg0 → VPN tunnel (if configured) | 22.7k |
| PASS | out | tcp | 853 | → encrypted DNS (DoT, Quad9) | 9.1k |
| PASS | any | any | — | lo (loopback) | — |
| PASS | in/out | any | — | wg0 (inside the tunnel) | 48.2k |
| BLOCK | in | any | * | * → host | 1.2k |
| BLOCK | out | any | * | outside the tunnel (kill switch) | 340 |