Skip to content

Commit db1097b

Browse files
committed
ffbs-parker-nodeconfig: firewall: Allow respondd from all internal addr
This firewall rules make sure, that respondd is only accessible from inside the Freifunk network (client network or VPN) - but not from other interfaces (e.g. `br-wan`). While we were only using it for Freifunk Braunschweig the `src_ip` limitation did not really matter: Per definition these are the only IPv6 addresses on these interfaces anyway. But while preparing this tooling for a wider use we should rethink this decision. There is no need to limit access to a specific IPv6 range, as long as the requests are still coming from the inside.
1 parent 124573c commit db1097b

File tree

1 file changed

+1
-3
lines changed

1 file changed

+1
-3
lines changed

ffbs-parker-nodeconfig/files/lib/gluon/upgrade/904-parker-firewall

+1-3
Original file line numberDiff line numberDiff line change
@@ -52,19 +52,17 @@ uci set firewall.vpn_parker_mesh='forwarding'
5252
uci set firewall.vpn_parker_mesh.src='vpn_parker'
5353
uci set firewall.vpn_parker_mesh.dest='mesh'
5454

55-
# allow respondd to be reached from mesh an vpn_parker
55+
# allow respondd to be reached from mesh and vpn_parker
5656
uci set firewall.respondd_mesh_parker=rule
5757
uci set firewall.respondd_mesh_parker.dest_port='1001'
5858
uci set firewall.respondd_mesh_parker.name='respondd_mesh_parker'
59-
uci set firewall.respondd_mesh_parker.src_ip='2001:bf7:381::/64'
6059
uci set firewall.respondd_mesh_parker.target='ACCEPT'
6160
uci set firewall.respondd_mesh_parker.proto='udp'
6261
uci set firewall.respondd_mesh_parker.src='mesh'
6362

6463
uci set firewall.respondd_vpn_parker_mesh=rule
6564
uci set firewall.respondd_vpn_parker_mesh.dest_port='1001'
6665
uci set firewall.respondd_vpn_parker_mesh.name='respondd_vpn_parker_mesh'
67-
uci set firewall.respondd_vpn_parker_mesh.src_ip='2001:bf7:381::/64'
6866
uci set firewall.respondd_vpn_parker_mesh.target='ACCEPT'
6967
uci set firewall.respondd_vpn_parker_mesh.proto='udp'
7068
uci set firewall.respondd_vpn_parker_mesh.src='vpn_parker'

0 commit comments

Comments
 (0)