Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Only accept dns requests going to internal IPs #28

Closed
wants to merge 2 commits into from
+2 −2
Closed

Only accept dns requests going to internal IPs #28

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
00fc54a
only accept dns going to local IPs
james-otten Oct 18, 2024
ef001de
allow from meshaddr
james-otten Oct 19, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion Omnitik5AC/omni-only-ros7.rsc.tmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -138,7 +138,7 @@ add address=23.158.16.0/24 list=meshaddr

/ip firewall filter
add action=accept chain=input protocol=icmp
add action=accept chain=input dst-port=53 protocol=udp
add action=accept chain=input dst-port=53 protocol=udp dst-address=10.0.0.0/8
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should we use the meshaddr address list instead?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It includes 2 public mesh IP blocks which I think we want to deny just in case something from one of them gets assigned to an omni. This applies to just the input filter, and not the forward filter, so users can still access DNS servers at public mesh IPs.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm of the same mind as Andrew here. We should be using src-address-list=meshaddr similar to the "drop input if not from meshaddr" line a few lines down. It is a little odd to have a dst-address here for the input, and actually this would break the use-case that Andrew and I were talking about a few days ago where we would have a public IP routed to the member's router and they reply to the public IP on the router.

The reason for this allow line even though we have an input drop line is to allow wlan2 users to access dns despite not being allowed to access the router's management interface. So, another option is to just add in-bridge-port=wlan2 on this line instead of your suggestion, which would resolve that problem, and everyone else would be covered by the "drop input if not from meshaddr".

Thoughts?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think I misread at fist thinking about dest not src. Updated to src-address-list=meshaddr

add action=accept chain=input connection-state=established,related
add action=drop chain=input in-bridge-port=wlan2
add action=drop chain=input src-address-list=!meshaddr
Expand Down
2 changes: 1 addition & 1 deletion Omnitik5AC/omni-poe-ether5-ros7.rsc.tmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -142,7 +142,7 @@ add address=23.158.16.0/24 list=meshaddr

/ip firewall filter
add action=accept chain=input protocol=icmp
add action=accept chain=input dst-port=53 protocol=udp
add action=accept chain=input dst-port=53 protocol=udp dst-address=10.0.0.0/8
add action=accept chain=input connection-state=established,related
add action=drop chain=input in-bridge-port=wlan2
add action=drop chain=input src-address-list=!meshaddr
Expand Down