TinyBacklog/relapse-exploit-docker
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Restrict guide gateway DNS to the console VLAN

Browse Source 
Add an ALLOWED_CLIENTS source-address filter to the DNS service so it only
answers queries from the authorized PS5 VLAN (192.168.40.0/28 by default).
Queries from any other source address are dropped and logged as "denied" on
both UDP and TCP. The value accepts a comma-separated mix of individual
addresses and CIDR ranges, and an empty value disables the filter.

Record the two authorized consoles (PS5PRO 192.168.40.14, PS5FAT
192.168.40.13) and the stale 192.168.10.x workstation address in the docs.

Co-Authored-By: Claude Opus 4.8 <[email protected]>
This commit is contained in:
kadinho
2026-10-11 13:22:54 +01:00
co-authored by Claude Opus 4.8
parent 74a412ded8
commit 7292a500eb
4 changed files with 55 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/HANDOFF.md
+16 -4
View File
@@ -163,10 +163,12 @@ successful smoke test; user selection is separate from evidence.
## PS5 and DNS state
The PS5 now uses the static address:
Two authorized consoles now use static addresses on the console VLAN
`192.168.40.0/28`:
```text
192.168.40.14
PS5PRO 192.168.40.14
PS5FAT 192.168.40.13
```
The local HTTP endpoint is available and verified at:
@@ -191,6 +193,14 @@ Library and BlackBox while continuing to block PSN and update resolution. The PS
sends DNS only to `net-utils01`; that host must be allowed to reach the configured
upstream resolver on UDP/TCP 53.
The gateway additionally restricts which source clients it answers. `ALLOWED_CLIENTS`
defaults to the console VLAN `192.168.40.0/28`; queries from any other source address
are dropped and logged as `denied`, on both UDP and TCP. The value accepts a
comma-separated mix of individual addresses and CIDR ranges, and an empty value
disables the filter. This keeps the service dedicated to the two authorized consoles
and prevents other LAN hosts from using it as an open resolver for the allowlisted
names.
The Payload Manager review used upstream commit
`e4e72dc9d831dd09ee8fabc222ad1e7f5139050e` and the official catalog current on
2026-10-07. Its fixed catalog URL uses `itsplk.github.io`; all 25 catalog download
@@ -218,8 +228,10 @@ Vikingfile and their download infrastructure are intentionally excluded: they se
third-party game files, many catalog entries have no SHA-256, and those hosts are
not required for catalog browsing or BlackBox updates.
The PS5 was previously identified as `192.168.10.26`; requests from
`192.168.10.6` seen at that time were from a different client. Those addresses
are historical and must not be used as the current payload destination.
`192.168.10.6` seen at that time were from the operator's own workstation, not a
console, before the consoles were moved onto VLAN 40. All `192.168.10.0/24`
addresses are historical and must not be used as the current payload destination;
with `ALLOWED_CLIENTS` set to `192.168.40.0/28` they can no longer query the gateway.
The PS5 ELF loader listens on TCP port `9021` after a successful exploit run. On
2026-10-01, a connection-only probe from `net-utils01` to