firewall: make logging rules best-effort on limited kernels

Author: benvinegar

bin/setup-firewall.sh

@@ -34,6 +34,12 @@ fi
 
 CHAIN="BAUDBOT_OUTPUT"
 
+add_optional_rule() {
+  if ! iptables -w "$@"; then
+    echo "⚠️  Optional firewall rule unsupported by kernel, skipping: iptables -w $*" >&2
+  fi
+}
+
 echo "🔒 Setting up firewall rules for $BAUDBOT_AGENT_USER (uid $UID_BAUDBOT)..."
 
 # Clean up any existing rules first
@@ -45,10 +51,10 @@ iptables -w -X "$CHAIN" 2>/dev/null || true
 iptables -w -N "$CHAIN"
 
 # ── Logging (SYN + DNS only — low volume) ────────────────────────────────────
-# Log all new outbound connections (SYN packets only to avoid flooding)
-iptables -w -A "$CHAIN" -p tcp --syn -j LOG --log-prefix "baudbot-out: " --log-level info
-# Log DNS queries
-iptables -w -A "$CHAIN" -p udp --dport 53 -j LOG --log-prefix "baudbot-dns: " --log-level info
+# Some kernels (notably certain cloud Arch images) lack optional LOG/tcp xtables
+# modules. Treat logging rules as best-effort; the allow/drop policy is mandatory.
+add_optional_rule -A "$CHAIN" -p tcp --syn -j LOG --log-prefix "baudbot-out: " --log-level info
+add_optional_rule -A "$CHAIN" -p udp --dport 53 -j LOG --log-prefix "baudbot-dns: " --log-level info
 
 # ── Localhost: allow only specific services ──────────────────────────────────
 
@@ -88,7 +94,7 @@ iptables -w -A "$CHAIN" -o lo -p tcp --dport 53 -j ACCEPT
 iptables -w -A "$CHAIN" -o lo -m state --state ESTABLISHED,RELATED -j ACCEPT
 
 # Block everything else on localhost
-iptables -w -A "$CHAIN" -o lo -j LOG --log-prefix "BAUDBOT_LOCAL_BLOCKED: " --log-level 4
+add_optional_rule -A "$CHAIN" -o lo -j LOG --log-prefix "BAUDBOT_LOCAL_BLOCKED: " --log-level 4
 iptables -w -A "$CHAIN" -o lo -j DROP
 
 # ── Internet: allow standard + dev ports ─────────────────────────────────────
@@ -118,7 +124,7 @@ iptables -w -A "$CHAIN" -p tcp --dport 4317:4318 -j ACCEPT
 iptables -w -A "$CHAIN" -m state --state ESTABLISHED,RELATED -j ACCEPT
 
 # Log and drop everything else
-iptables -w -A "$CHAIN" -j LOG --log-prefix "BAUDBOT_BLOCKED: " --log-level 4
+add_optional_rule -A "$CHAIN" -j LOG --log-prefix "BAUDBOT_BLOCKED: " --log-level 4
 iptables -w -A "$CHAIN" -j DROP
 
 # Jump to our chain for all baudbot_agent traffic