Designing an allowlist without locking yourself out
Safe exposure rules for private service-to-service links.
This note documents a practical approach used in Steppe Infrastructure Notes. The goal is a setup that can be explained, reproduced, and checked from outside the machine.
Define the callers first
A relay that serves one upstream server does not need a public listener for everyone. Write down the expected source addresses and test them from the real machines, including any NAT or dual-stack behaviour.
nft list ruleset
ip route get 192.0.2.20Avoid competing rule writers
Two firewall scripts managing the same port can produce different results after a reboot. Consolidate them into one persistent unit and remove obsolete rules rather than adding another emergency exception.
systemctl list-unit-files
nft -a list chain ip filter INPUTTest both sides of the policy
Confirm that the intended caller connects and that an independent host receives a timeout or reject. Then send application traffic; an open TCP port is not proof that the proxied protocol still works.
nc -vz -w 5 relay.example 443