CHAT_OUTPUT_BEGIN
COMMAND_ID=SUPPORT-260922-SPB-VM130-EGRESS-POLICY-RCA-9128R1
STATUS=OK
RC=0
HOST=pve01
MODE=read-only
COMPONENT=spb-vm130-egress-policy-rca
REFERENCE_REGISTER_CHECK=OK
REFERENCE_SHA256=5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66
ERROR_REGISTER_CHECK=OK
ERROR_REGISTER_SHA256=3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0
COMMAND_SHA256=f865795e23fb24fac99743dd841426764468398337cbd94620e4375f63f0e7aa
DUPLICATE_FAILED_COMMAND_BLOCKED=false
EXECUTION_STARTED=true
CHANGE_DECLARED=false
RESULT_CONTRACT_VALID=true
RESULT_CONTRACT_STATUS=NOT_APPLICABLE
RESULT_CONTRACT_ERROR=NONE
COMMAND_RC=0
CHANGES_MADE=false
ROLLBACK_STARTED=false
ROLLBACK_RESTORED=null
MUTATION_OUTCOME=NO_MUTATION
SANITIZED=yes
SECRETS_INCLUDED=no
PRIVATE_ADDRESSES_INCLUDED=no
RAW_EVIDENCE_SHA256=d1816f7ff23d0f00248ea20c4a08fb014eb704408ff67fb309d2661a3ff2b340
SANITIZED_OUTPUT_SHA256=d1816f7ff23d0f00248ea20c4a08fb014eb704408ff67fb309d2661a3ff2b340
OUTPUT_BEGIN
SPB9128_RCA={"guest":{"ok":true,"data":{"hostname":"edge-vm","netbird_service":"active","default_v4":true,"targets":{"acme-v02.api.letsencrypt.org":[{"ip_hash":"5786251088dd9c13","route":{"rc":0,"stderr_sha":null,"dev":"wt0","has_via":false,"line_hash":"5a49954884866ec5"},"tcp443":{"ok":false,"error":"OSError"}}],"api.cloudflare.com":[{"ip_hash":"b0744ce2a1b023db","route":{"rc":0,"stderr_sha":null,"dev":"wt0","has_via":false,"line_hash":"7cb5cee0ebb33f07"},"tcp443":{"ok":false,"error":"OSError"}},{"ip_hash":"c6984b66666387ed","route":{"rc":0,"stderr_sha":null,"dev":"wt0","has_via":false,"line_hash":"cfffc0defbd50741"},"tcp443":{"ok":false,"error":"OSError"}},{"ip_hash":"969b1202bb584ec5","route":{"rc":0,"stderr_sha":null,"dev":"wt0","has_via":false,"line_hash":"9d264f8ab0166b91"},"tcp443":{"ok":false,"error":"OSError"}},{"ip_hash":"11f9ecc608d7a6f3","route":{"rc":0,"stderr_sha":null,"dev":"wt0","has_via":false,"line_hash":"6f64c9a460831f9e"},"tcp443":{"ok":false,"error":"OSError"}}],"1.1.1.1":[{"ip_hash":"f1412386aa8db257","route":{"rc":0,"stderr_sha":null,"dev":"wt0","has_via":false,"line_hash":"1cf8f6049ad12605"},"tcp53":{"ok":false,"error":"OSError"},"tcp443":{"ok":false,"error":"OSError"}}],"8.8.8.8":[{"ip_hash":"838c4c2573848f58","route":{"rc":0,"stderr_sha":null,"dev":"wt0","has_via":false,"line_hash":"f67ace164f3792ff"},"tcp53":{"ok":false,"error":"OSError"},"tcp443":{"ok":false,"error":"OSError"}}]},"ip_rules":["0:\tfrom all lookup local","100:\tfrom [ADDR] lookup main","101:\tfrom [ADDR] lookup 17777","105:\tfrom all lookup main suppress_prefixlength 0","110:\tnot from all fwmark 0x1bd00 lookup 7120","32766:\tfrom all lookup main","32767:\tfrom all lookup default"],"ip_routes":["default dev wg-edge01 table 17777 scope link ","default dev wt0 table 7120 ","default via [ADDR] dev eth0 proto static ","[ADDR] dev wg-taftauto proto kernel scope link src [ADDR] ","[ADDR] dev wg-edge01 proto kernel scope link src [ADDR] ","[ADDR] dev br-915a81681c3e proto kernel scope link src [ADDR] ","[ADDR] dev wt0 proto kernel scope link src [ADDR] ","[ADDR] dev docker0 proto kernel scope link src [ADDR] linkdown ","[ADDR] dev br-4d894f9e427b proto kernel scope link src [ADDR] linkdown ","[ADDR] dev br-d41b3e918fbc proto kernel scope link src [ADDR] ","[ADDR] dev br-a4e31561a8d5 proto kernel scope link src [ADDR] ","[ADDR] via [ADDR] dev eth0 src [ADDR] ","[ADDR] dev eth0 proto kernel scope link src [ADDR] ","[ADDR] dev br-f43db13d76c4 proto kernel scope link src [ADDR] ","[ADDR] dev br-8122fec51f39 proto kernel scope link src [ADDR] ","[ADDR] dev br-5f66e1018bdd proto kernel scope link src [ADDR] ","local [ADDR] dev wg-taftauto table local proto kernel scope host src [ADDR] ","broadcast [ADDR] dev wg-taftauto table local proto kernel scope link src [ADDR] ","local [ADDR] dev wg-edge01 table local proto kernel scope host src [ADDR] ","broadcast [ADDR] dev wg-edge01 table local proto kernel scope link src [ADDR] ","local [ADDR] dev br-915a81681c3e table local proto kernel scope host src [ADDR] ","broadcast [ADDR] dev br-915a81681c3e table local proto kernel scope link src [ADDR] ","local [ADDR] dev wt0 table local proto kernel scope host src [ADDR] ","broadcast [ADDR] dev wt0 table local proto kernel scope link src [ADDR] ","local [ADDR] dev lo table local proto kernel scope host src [ADDR] ","local [ADDR] dev lo table local proto kernel scope host src [ADDR] ","broadcast [ADDR] dev lo table local proto kernel scope link src [ADDR] ","local [ADDR] dev docker0 table local proto kernel scope host src [ADDR] ","broadcast [ADDR] dev docker0 table local proto kernel scope link src [ADDR] linkdown ","local [ADDR] dev br-4d894f9e427b table local proto kernel scope host src [ADDR] ","broadcast [ADDR] dev br-4d894f9e427b table local proto kernel scope link src [ADDR] linkdown ","local [ADDR] dev br-d41b3e918fbc table local proto kernel scope host src [ADDR] ","broadcast [ADDR] dev br-d41b3e918fbc table local proto kernel scope link src [ADDR] ","local [ADDR] dev br-a4e31561a8d5 table local proto kernel scope host src [ADDR] ","broadcast [ADDR] dev br-a4e31561a8d5 table local proto kernel scope link src [ADDR] ","local [ADDR] dev eth0 table local proto kernel scope host src [ADDR] ","broadcast [ADDR] dev eth0 table local proto kernel scope link src [ADDR] ","local [ADDR] dev br-f43db13d76c4 table local proto kernel scope host src [ADDR] ","broadcast [ADDR] dev br-f43db13d76c4 table local proto kernel scope link src [ADDR] ","local [ADDR] dev br-8122fec51f39 table local proto kernel scope host src [ADDR] ","broadcast [ADDR] dev br-8122fec51f39 table local proto kernel scope link src [ADDR] ","local [ADDR] dev br-5f66e1018bdd table local proto kernel scope host src [ADDR] ","broadcast [ADDR] dev br-5f66e1018bdd table local proto kernel scope link src [ADDR] "],"sysctls":{"net.ipv4.conf.all.rp_filter":"0","net.ipv4.conf.all.src_valid_mark":"1","net.ipv4.ip_forward":"1"},"nft_output":[["\tchain OUTPUT { # handle 6","\t\ttype nat hook output priority dstnat; policy accept;","\t\tip daddr != [ADDR] fib daddr type local counter packets 155792 bytes 9523752 jump DOCKER # handle 7","\t}"],["\tchain OUTPUT { # handle 4","\t\ttype nat hook output priority dstnat; policy accept;","\t\tip6 daddr != [ADDR6] fib daddr type local counter packets 0 bytes 0 jump DOCKER # handle 5","\t}"],["\tchain netbird-raw-out { # handle 52","\t\ttype filter hook output priority raw; policy accept;","\t\toifname \"lo\" ip saddr [ADDR] ip daddr [ADDR] udp sport 51820 counter packets 64757 bytes 23705604 notrack # handle 54","\t\toifname \"lo\" ip saddr [ADDR] ip daddr [ADDR] udp dport 51820 counter packets 115388 bytes 22342160 notrack # handle 55","\t}"]],"nft_netbird":[["\tchain netbird-rt-fwd { # handle 31","\t\tct state established,related counter packets 2112153 bytes 3401847160 accept # handle 37","\t}"],["\tchain netbird-rt-postrouting { # handle 32","\t\ttype nat hook postrouting priority srcnat - 1; policy accept;","\t\tmeta mark 0x0001bd21 oifname != \"lo\" counter packets 0 bytes 0 masquerade # handle 38","\t\tmeta mark 0x0001bd22 oifname \"wt0\" counter packets 0 bytes 0 masquerade # handle 39","\t}"],["\tchain netbird-rt-redirect { # handle 33","\t\ttype nat hook prerouting priority dstnat; policy accept;","\t}"],["\tchain netbird-mangle-postrouting { # handle 34","\t\ttype filter hook postrouting priority mangle; policy accept;","\t\toifname \"wt0\" ct state new ct mark set 0x0001bd11 # handle 42","\t}"],["\tchain netbird-mangle-prerouting { # handle 35","\t\ttype filter hook prerouting priority mangle; policy accept;","\t\tiifname \"wt0\" ct state new ct mark set 0x0001bd10 # handle 41","\t\tiifname \"wt0\" ip saddr @nb0000001 fib daddr type local meta mark set 0x0001bd20 # handle 61","\t\tiifname \"wt0\" ip saddr @nb0000043 fib daddr type local meta mark set 0x0001bd20 # handle 64","\t\tiifname \"wt0\" ip saddr @nb0000055 fib daddr type local meta mark set 0x0001bd20 # handle 67","\t}"],["\tchain netbird-mangle-forward { # handle 36","\t\ttype filter hook forward priority mangle; policy accept;","\t\toifname \"wt0\" tcp flags syn counter packets 12281 bytes 736860 tcp option maxseg size > 1240 tcp option maxseg size set 1240 # handle 40","\t}"],["\tchain netbird-acl-input-rules { # handle 43","\t\tct state established,related counter packets 7605032 bytes 6107862874 accept # handle 44","\t\tip saddr @nb0000001 accept # handle 59","\t\tip saddr @nb0000043 accept # handle 63","\t\tip saddr @nb0000055 accept # handle 66","\t}"],["\tchain netbird-acl-input-filter { # handle 45","\t\ttype filter hook input priority filter; policy accept;","\t\tiifname \"wt0\" jump netbird-acl-input-rules # handle 46","\t\tiifname \"wt0\" drop # handle 47","\t}"],["\tchain netbird-acl-forward-filter { # handle 48","\t\ttype filter hook forward priority filter; policy accept;","\t\tmeta mark 0x0001bd20 accept # handle 51","\t\tiifname \"wt0\" jump netbird-rt-fwd # handle 49","\t\tiifname \"wt0\" drop # handle 50","\t}"],["\tchain netbird-raw-out { # handle 52","\t\ttype filter hook output priority raw; policy accept;","\t\toifname \"lo\" ip saddr [ADDR] ip daddr [ADDR] udp sport 51820 counter packets 64757 bytes 23705604 notrack # handle 54","\t\toifname \"lo\" ip saddr [ADDR] ip daddr [ADDR] udp dport 51820 counter packets 115388 bytes 22342160 notrack # handle 55","\t}"],["\tchain netbird-raw-pre { # handle 53","\t\ttype filter hook prerouting priority raw; policy accept;","\t\tiifname \"lo\" ip saddr [ADDR] ip daddr [ADDR] udp dport 51820 counter packets 84862 bytes 15870648 notrack # handle 56","\t\tiifname \"lo\" ip saddr [ADDR] ip daddr [ADDR] udp dport 3128 counter packets 64757 bytes 23705604 notrack # handle 57","\t}"],["\tchain netbird-rt-fwd { # handle 1","\t\tct state established,related counter packets 0 bytes 0 accept # handle 7","\t}"],["\tchain netbird-rt-postrouting { # handle 2","\t\ttype nat hook postrouting priority srcnat - 1; policy accept;","\t\tmeta mark 0x0001bd21 oifname != \"lo\" counter packets 0 bytes 0 masquerade # handle 8","\t\tmeta mark 0x0001bd22 oifname \"wt0\" counter packets 0 bytes 0 masquerade # handle 9","\t}"],["\tchain netbird-rt-redirect { # handle 3","\t\ttype nat hook prerouting priority dstnat; policy accept;","\t}"],["\tchain netbird-mangle-postrouting { # handle 4","\t\ttype filter hook postrouting priority mangle; policy accept;","\t\toifname \"wt0\" ct state new ct mark set 0x0001bd11 # handle 12","\t}"],["\tchain netbird-mangle-prerouting { # handle 5","\t\ttype filter hook prerouting priority mangle; policy accept;","\t\tiifname \"wt0\" ct state new ct mark set 0x0001bd10 # handle 11","\t\tiifname \"wt0\" ip6 saddr @nb0000001 fib daddr type local meta mark set 0x0001bd20 # handle 25","\t\tiifname \"wt0\" ip6 saddr @nb0000043 fib daddr type local meta mark set 0x0001bd20 # handle 28","\t\tiifname \"wt0\" ip6 saddr @nb0000055 fib daddr type local meta mark set 0x0001bd20 # handle 31","\t}"],["\tchain netbird-mangle-forward { # handle 6","\t\ttype filter hook forward priority mangle; policy accept;","\t\toifname \"wt0\" tcp flags syn counter packets 0 bytes 0 tcp option maxseg size > 1220 tcp option maxseg size set 1220 # handle 10","\t}"],["\tchain netbird-acl-input-rules { # handle 13","\t\tct state established,related counter packets 12 bytes 3817 accept # handle 14","\t\tip6 saddr @nb0000001 accept # handle 23","\t\tip6 saddr @nb0000043 accept # handle 27","\t\tip6 saddr @nb0000055 accept # handle 30","\t}"],["\tchain netbird-acl-input-filter { # handle 15","\t\ttype filter hook input priority filter; policy accept;","\t\tiifname \"wt0\" jump netbird-acl-input-rules # handle 16","\t\tiifname \"wt0\" drop # handle 17","\t}"],["\tchain netbird-acl-forward-filter { # handle 18","\t\ttype filter hook forward priority filter; policy accept;","\t\tmeta mark 0x0001bd20 accept # handle 21","\t\tiifname \"wt0\" jump netbird-rt-fwd # handle 19","\t\tiifname \"wt0\" drop # handle 20","\t}"]],"nft_snikket":[],"iptables":[":OUTPUT ACCEPT [0:0]","-A PREROUTING -d [ADDR] ! -i br-f43db13d76c4 -j DROP","-A PREROUTING -d [ADDR] ! -i br-915a81681c3e -j DROP","-A PREROUTING -d [ADDR] ! -i br-a4e31561a8d5 -j DROP","-A PREROUTING -d [ADDR] ! -i br-8122fec51f39 -j DROP","-A PREROUTING -d [ADDR] ! -i br-5f66e1018bdd -j DROP","-A PREROUTING -d [ADDR] ! -i br-915a81681c3e -j DROP","-A PREROUTING -d [ADDR] ! -i lo -p tcp -m tcp --dport 2375 -j DROP","-A PREROUTING -d [ADDR] ! -i lo -p tcp -m tcp --dport 8081 -j DROP","-A PREROUTING -d [ADDR] ! -i br-5f66e1018bdd -j DROP","-A PREROUTING -d [ADDR] ! -i lo -p tcp -m tcp --dport 7422 -j DROP","-A PREROUTING -d [ADDR] ! -i lo -p tcp -m tcp --dport 8088 -j DROP","-A PREROUTING -d [ADDR] ! -i br-915a81681c3e -j DROP","-A PREROUTING -d [ADDR] ! -i br-915a81681c3e -j DROP","-A PREROUTING -d [ADDR] ! -i lo -p tcp -m tcp --dport 12345 -j DROP","-A PREROUTING -d [ADDR] ! -i br-915a81681c3e -j DROP","-A PREROUTING -d [ADDR] ! -i lo -p tcp -m tcp --dport 3100 -j DROP","-A PREROUTING -d [ADDR] ! -i br-915a81681c3e -j DROP","-A PREROUTING -d [ADDR] ! -i br-d41b3e918fbc -j DROP","-A PREROUTING -d [ADDR] ! -i lo -p tcp -m tcp --dport 9999 -j DROP",":FORWARD ACCEPT [4378479:806482115]",":OUTPUT ACCEPT [0:0]","-A INPUT ! -i lo -p tcp -m tcp --dport 81 -j DROP","-A DOCKER ! -i br-4d894f9e427b -o br-4d894f9e427b -j DROP","-A DOCKER ! -i br-5f66e1018bdd -o br-5f66e1018bdd -j DROP","-A DOCKER ! -i br-8122fec51f39 -o br-8122fec51f39 -j DROP","-A DOCKER ! -i br-915a81681c3e -o br-915a81681c3e -j DROP","-A DOCKER ! -i br-a4e31561a8d5 -o br-a4e31561a8d5 -j DROP","-A DOCKER ! -i br-d41b3e918fbc -o br-d41b3e918fbc -j DROP","-A DOCKER ! -i br-f43db13d76c4 -o br-f43db13d76c4 -j DROP","-A DOCKER ! -i docker0 -o docker0 -j DROP",":OUTPUT ACCEPT [6007854:372026992]","-A OUTPUT ! -d [ADDR] -m addrtype --dst-type LOCAL -j DOCKER"]}},"pve03":{"rc":0,"lines":["QM_CONFIG_BEGIN","name: edge-vm","net0: virtio=[ADDR6],bridge=vmbr0,firewall=1","QM_CONFIG_END","FWFILE=/etc/pve/firewall/cluster.fw EXISTS=1","2:enable: 1","3:policy_in: DROP","4:policy_out: ACCEPT","7:IN ACCEPT -source [ADDR]","8:IN ACCEPT -source [ADDR]","9:IN ACCEPT -source [ADDR]","10:IN ACCEPT -source [ADDR] -p tcp -dport 22","11:IN ACCEPT -source [ADDR] -p tcp -dport 8006","12:IN ACCEPT -source [ADDR] -p tcp -dport 9100","13:IN ACCEPT -source [ADDR] -p tcp -dport 9101","14:IN ACCEPT -source [ADDR] -p tcp -dport 22","15:IN ACCEPT -source [ADDR] -p tcp -dport 8006","16:IN ACCEPT -p icmp","FWFILE=/etc/pve/firewall/130.fw EXISTS=1","2:enable: 1","3:policy_in: ACCEPT","4:policy_out: ACCEPT","7:OUT DROP -dest [ADDR] -log nolog","8:OUT DROP -dest [ADDR] -log nolog","9:OUT DROP -dest [ADDR] -log nolog","FWFILE=/etc/pve/nodes/pve03/host.fw EXISTS=1","3:enable: 1","PVEFW_BEGIN","Status: enabled/running","PVEFW_END","LINKS_BEGIN","vmbr0            UP             [ADDR6] <BROADCAST,MULTICAST,UP,LOWER_UP> ","tap130i0         UNKNOWN        [ADDR6] <BROADCAST,MULTICAST,PROMISC,UP,LOWER_UP> ","fwbr130i0        UP             [ADDR6] <BROADCAST,MULTICAST,UP,LOWER_UP> ","fwpr130p0@fwln130i0 UP             [ADDR6] <BROADCAST,MULTICAST,UP,LOWER_UP> ","fwln130i0@fwpr130p0 UP             [ADDR6] <BROADCAST,MULTICAST,UP,LOWER_UP> ","LINKS_END","BRIDGE_BEGIN","4: nic1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 master vmbr0 state forwarding priority 32 cost 4 ","7: tap130i0: <BROADCAST,MULTICAST,PROMISC,UP,LOWER_UP> mtu 1500 master fwbr130i0 state forwarding priority 32 cost 2 ","9: fwpr130p0@fwln130i0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 master vmbr0 state forwarding priority 32 cost 2 ","10: fwln130i0@fwpr130p0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 master fwbr130i0 state forwarding priority 32 cost 2 ","13: fwpr190p0@fwln190i0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 master vmbr0 state forwarding priority 32 cost 2 ","22: fwpr211p0@fwln211i0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 master vmbr0 state forwarding priority 32 cost 2 ","BRIDGE_END","NFT_BEGIN","NFT_END","PVE03_TCP={\"[ADDR]:53\":true,\"[ADDR]:443\":true,\"[ADDR]:53\":true,\"[ADDR]:443\":true}"],"stderr_sha":null}}
TASK_COMPLETE=true
TASK_RESULT=PASS_SPB_VM130_EGRESS_POLICY_RCA
DECISION=READ_EXACT_9128_THEN_REPAIR_ONLY_PROVEN_LAYER

OUTPUT_END
CHAT_OUTPUT_END
