From c1a6a6511b553c80a13342e3aac5837a8cdb0d43 Mon Sep 17 00:00:00 2001 From: Clayton Craft Date: Tue, 17 Aug 2021 17:06:56 -0700 Subject: [PATCH] postmarketos-config-nftables: allow DNS from wlan* (MR 2448) This fixes DNS when a system is connected to a pmOS device as a hotspot. The rule is in the default set of firewall rules, instead of a subpackage.. I think this is OK. I don't believe anything should be listening on port 53 except when the hotspot is running... --- main/postmarketos-config-nftables/APKBUILD | 4 +++- .../postmarketos-config-nftables/rules/51_hotspot.nft | 11 +++++++++++ 2 files changed, 14 insertions(+), 1 deletion(-) create mode 100644 main/postmarketos-config-nftables/rules/51_hotspot.nft diff --git a/main/postmarketos-config-nftables/APKBUILD b/main/postmarketos-config-nftables/APKBUILD index 05229524a..e69cb2801 100644 --- a/main/postmarketos-config-nftables/APKBUILD +++ b/main/postmarketos-config-nftables/APKBUILD @@ -1,6 +1,6 @@ # Maintainer: Clayton Craft pkgname=postmarketos-config-nftables -pkgver=0.4 +pkgver=0.5 pkgrel=0 pkgdesc="nftables firewall configuration for postmarketOS" url="https://gitlab.com/postmarketos" @@ -19,6 +19,7 @@ source=" rules/10_dhcp.nft rules/50_ssh.nft rules/51_anbox.nft + rules/51_hotspot.nft rules/51_usb_inet.nft rules/60_usb.nft rules/99_drop_log.nft @@ -71,6 +72,7 @@ sha512sums=" d5a7c7fc47924acfafee42d731e6a0109d83af6278053128deecbf3cf40e37447cb649360ee9ebddd2a5ea276888314b63ce7ef828708b5bf7dd1bface7fbc62 10_dhcp.nft 6b0d0c7c3368dde1ad61d26a0c2e13008f16d5bedaf11fa4a3511b49675505cbbdda8bf8ff158194846b197108f76bdfd66d40a2afb9f4d25c79b02acf5659b7 50_ssh.nft 8322a8a5a5b1e98e1f44e2091b8b3a06db1e8309ebba5b8b6abe9d6fbb009dffb248af55e631f06f01bbced98b23c205462de73cd354b116dbaa7b6c72746bfd 51_anbox.nft +c3c1dba2d10161ca8081f4adcb4dfc6dda4fcd3bc5c473a80d7260e4cdcf071997fc1a28789dcc0f06689c77fc6b477335af5a783ce558192eb897fb27500676 51_hotspot.nft bceb1a12a9de044daa3a4ba647b0d69b257881151a912fc350d6a00fdf0c0903b51fb58c56cfc73e9a75f529bac841d41d466e0f210b1f516e124e69cbfd1feb 51_usb_inet.nft 0e86974602622c03f0b34acd048e3a31157c0226ab4b5ec093a19696af3fc9637ed84cecf0d190941e4bd3afeb0c76a37245fa850abef46778cd1235ad8106df 60_usb.nft 1532899534d7432a7708620cf1053ab80635fffe038a2352eb890c35fba4247c3b9ab3d0b028da1be765e5feb9b5a5b3a8107f4aa79f790d17930d38535a2288 99_drop_log.nft diff --git a/main/postmarketos-config-nftables/rules/51_hotspot.nft b/main/postmarketos-config-nftables/rules/51_hotspot.nft new file mode 100644 index 000000000..ff0e49022 --- /dev/null +++ b/main/postmarketos-config-nftables/rules/51_hotspot.nft @@ -0,0 +1,11 @@ +#!/usr/sbin/nft -f + +table inet filter { + chain input { + + # allow DNS from wlan* + iifname "wlan*" tcp dport 53 accept comment "Accept DNS over TCP on wlan*" + iifname "wlan*" udp dport 53 accept comment "Accept DNS over UDP on wlan*" + + } +}