Skip to content

Commit

Permalink
ffbs-parker-nodeconfig: firewall: Allow respondd from all internal addr
Browse files Browse the repository at this point in the history
This firewall rules make sure, that respondd is only accessible from
inside the Freifunk network (client network or VPN) - but not from other
interfaces (e.g. `br-wan`).

While we were only using it for Freifunk Braunschweig the `src_ip`
limitation did not really matter:
Per definition these are the only IPv6 addresses on these interfaces
anyway.

But while preparing this tooling for a wider use we should rethink this
decision.
There is no need to limit access to a specific IPv6 range, as long as
the requests are still coming from the inside.
  • Loading branch information
SmithChart committed Nov 6, 2024
1 parent 124573c commit db1097b
Showing 1 changed file with 1 addition and 3 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -52,19 +52,17 @@ uci set firewall.vpn_parker_mesh='forwarding'
uci set firewall.vpn_parker_mesh.src='vpn_parker'
uci set firewall.vpn_parker_mesh.dest='mesh'

# allow respondd to be reached from mesh an vpn_parker
# allow respondd to be reached from mesh and vpn_parker
uci set firewall.respondd_mesh_parker=rule
uci set firewall.respondd_mesh_parker.dest_port='1001'
uci set firewall.respondd_mesh_parker.name='respondd_mesh_parker'
uci set firewall.respondd_mesh_parker.src_ip='2001:bf7:381::/64'
uci set firewall.respondd_mesh_parker.target='ACCEPT'
uci set firewall.respondd_mesh_parker.proto='udp'
uci set firewall.respondd_mesh_parker.src='mesh'

uci set firewall.respondd_vpn_parker_mesh=rule
uci set firewall.respondd_vpn_parker_mesh.dest_port='1001'
uci set firewall.respondd_vpn_parker_mesh.name='respondd_vpn_parker_mesh'
uci set firewall.respondd_vpn_parker_mesh.src_ip='2001:bf7:381::/64'
uci set firewall.respondd_vpn_parker_mesh.target='ACCEPT'
uci set firewall.respondd_vpn_parker_mesh.proto='udp'
uci set firewall.respondd_vpn_parker_mesh.src='vpn_parker'
Expand Down

0 comments on commit db1097b

Please sign in to comment.