Add configurable VPN access policies (#1505)

## Summary

- add independent install options for internet routing, client-to-client
access, and explicit server-side networks
- enforce the selected policy across firewalld, nftables, and iptables,
including DCO traffic
- use destination-scoped NAT for home LAN access and preserve client
routes and DNS in split-tunnel mode
- document the new defaults and add focused Docker policy coverage

Defaults remain internet access enabled, client-to-client access
disabled, and server-side network access disabled.


Related: #1496 #443 #385 #624 #547 #1436 #1103 #1126 #575 #1434 #1213
#147

test/local-network-detection.sh

@@ -0,0 +1,92 @@
+#!/bin/bash
+# shellcheck disable=SC1091,SC2034
+# SC1091: The installer path is provided by the test environment.
+# SC2034: VPN subnet globals are consumed by sourced installer functions.
+set -euo pipefail
+
+INSTALLER=${1:-/opt/openvpn-install.sh}
+TEMP_DIR=$(mktemp -d)
+trap 'rm -rf "$TEMP_DIR"' EXIT
+
+cat >"$TEMP_DIR/ip" <<'EOF'
+#!/bin/bash
+case "$*" in
+"-4 -o route show type unicast")
+	cat <<'ROUTES'
+default via 167.172.176.1 dev public0
+10.8.0.0/24 dev tun-test proto kernel scope link
+10.19.0.0/16 dev public0 proto kernel scope link src 10.19.0.5
+10.135.0.0/16 dev eth1 proto kernel scope link src 10.135.0.2
+10.135.0.0/16 dev eth1 proto kernel scope link src 10.135.0.2
+10.200.0.0/16 via 10.135.0.1 dev eth1
+100.64.0.0/10 dev tailscale0 proto kernel scope link
+169.254.0.0/16 dev eth1 proto kernel scope link
+172.20.0.0/16 dev docker0 proto kernel scope link
+192.168.50.0/24 dev lan0 proto kernel scope link
+203.0.113.0/24 dev public0 proto kernel scope link
+ROUTES
+	;;
+"-6 -o route show type unicast")
+	cat <<'ROUTES'
+default via fe80::1 dev public0
+fc00:1::/64 via fd12:3456::1 dev lan0
+fd12:3456::/64 dev lan0 proto kernel metric 256
+fe80::/64 dev public0 proto kernel metric 256
+2001:db8::/64 dev public0 proto kernel metric 256
+ROUTES
+	;;
+"-4 -o address show dev public0 scope global")
+	cat <<'ADDRESSES'
+2: public0 inet 203.0.113.10/24 brd 203.0.113.255 scope global public0
+2: public0 inet 10.19.0.5/16 brd 10.19.255.255 scope global public0
+ADDRESSES
+	;;
+"-4 -o address show dev eth1 scope global")
+	echo "3: eth1 inet 10.135.0.2/16 brd 10.135.255.255 scope global eth1"
+	;;
+esac
+EOF
+chmod +x "$TEMP_DIR/ip"
+
+export FORCE_COLOR=0 LOG_FILE="" NON_INTERACTIVE_INSTALL=n OUTPUT_FORMAT=table
+# shellcheck source=../openvpn-install.sh
+source "$INSTALLER"
+PATH="$TEMP_DIR:$PATH"
+
+VPN_SUBNET_IPV4=10.8.0.0
+VPN_SUBNET_IPV6=fd42:42:42:42::
+
+assert_equal() {
+	local expected="$1" actual="$2" description="$3"
+	if [[ $actual != "$expected" ]]; then
+		echo "FAIL: $description" >&2
+		echo "Expected: $expected" >&2
+		echo "Actual:   $actual" >&2
+		exit 1
+	fi
+}
+
+assert_equal \
+	"10.135.0.0/16,172.20.0.0/16,192.168.50.0/24,fd12:3456::/64" \
+	"$(detect_private_local_networks y y)" \
+	"detects unique, directly connected RFC1918 and ULA networks"
+assert_equal \
+	"10.135.0.0/16,172.20.0.0/16,192.168.50.0/24" \
+	"$(detect_private_local_networks y n)" \
+	"honors IPv4-only client configuration"
+assert_equal \
+	"fd12:3456::/64" \
+	"$(detect_private_local_networks n y)" \
+	"honors IPv6-only client configuration"
+assert_equal "" "$(detect_private_local_networks n n)" "returns an empty list when both families are disabled"
+
+if is_private_ipv4_network 10.0.0.0/7; then
+	echo "FAIL: IPv4 network broader than RFC1918 space was accepted" >&2
+	exit 1
+fi
+if is_private_ipv6_network fc00::/6; then
+	echo "FAIL: IPv6 network broader than ULA space was accepted" >&2
+	exit 1
+fi
+
+echo "PASS: Local network candidate detection"