diff --git a/compose.yaml b/compose.yaml index b863dec..53d894c 100644 --- a/compose.yaml +++ b/compose.yaml @@ -22,7 +22,7 @@ services: REDIRECT_URL: "${GUIDE_REDIRECT_URL:-http://192.168.20.30:8000/}" FORWARDED_DOMAINS: "${FORWARDED_DOMAINS:-homebrew.page,itsplk.github.io,store.spectrumlibrary.online,api.github.com,github.com,raw.githubusercontent.com,release-assets.githubusercontent.com,prosperopatches.com,cdn.prosperopatches.com,image.api.playstation.com,gmedia.playstation.com}" UPSTREAM_DNS: "${UPSTREAM_DNS:-1.1.1.1}" - ALLOWED_CLIENTS: "${ALLOWED_CLIENTS:-192.168.40.0/28}" + ALLOWED_CLIENTS: "${ALLOWED_CLIENTS:-192.168.40.0/28,192.168.20.0/24,192.168.10.0/27}" ports: - "${GATEWAY_BIND_IP:-192.168.20.30}:53:8053/udp" - "${GATEWAY_BIND_IP:-192.168.20.30}:53:8053/tcp" diff --git a/docker/guide_gateway.py b/docker/guide_gateway.py index d2c63b7..1952627 100644 --- a/docker/guide_gateway.py +++ b/docker/guide_gateway.py @@ -26,12 +26,16 @@ FORWARDED_DOMAINS = frozenset( ) UPSTREAM_DNS = str(ipaddress.ip_address(os.environ.get("UPSTREAM_DNS", "1.1.1.1"))) UPSTREAM_TIMEOUT = 3.0 -# Source networks allowed to query the DNS service (PS5 VLAN by default). -# Accepts comma-separated individual addresses and CIDR ranges; empty disables -# the filter and serves every client. +# Source networks allowed to query the DNS service. Defaults to the console VLAN +# plus the server and trusted-management VLANs. Accepts a comma-separated mix of +# individual addresses and CIDR ranges; empty disables the filter and serves +# every client. ALLOWED_CLIENTS = tuple( ipaddress.ip_network(entry.strip(), strict=False) - for entry in os.environ.get("ALLOWED_CLIENTS", "192.168.40.0/28").split(",") + for entry in os.environ.get( + "ALLOWED_CLIENTS", + "192.168.40.0/28,192.168.20.0/24,192.168.10.0/27", + ).split(",") if entry.strip() ) CERTIFICATE = "/srv/certificates/manuals.crt" diff --git a/docs/HANDOFF.md b/docs/HANDOFF.md index 931f84b..fb222e6 100644 --- a/docs/HANDOFF.md +++ b/docs/HANDOFF.md @@ -194,12 +194,14 @@ sends DNS only to `net-utils01`; that host must be allowed to reach the configur upstream resolver on UDP/TCP 53. The gateway additionally restricts which source clients it answers. `ALLOWED_CLIENTS` -defaults to the console VLAN `192.168.40.0/28`; queries from any other source address -are dropped and logged as `denied`, on both UDP and TCP. The value accepts a -comma-separated mix of individual addresses and CIDR ranges, and an empty value -disables the filter. This keeps the service dedicated to the two authorized consoles -and prevents other LAN hosts from using it as an open resolver for the allowlisted -names. +defaults to the console VLAN `192.168.40.0/28`, the server VLAN `192.168.20.0/24`, +and the trusted management VLAN `192.168.10.0/27`; queries from any other source +address are dropped and logged as `denied`, on both UDP and TCP. The server and +trusted VLANs are included so operators can test and administer the resolver; the +consoles themselves only need the `/28`. The value accepts a comma-separated mix of +individual addresses and CIDR ranges, and an empty value disables the filter. This +keeps the service off the rest of the LAN and prevents arbitrary hosts from using it +as an open resolver for the allowlisted names. The Payload Manager review used upstream commit `e4e72dc9d831dd09ee8fabc222ad1e7f5139050e` and the official catalog current on @@ -230,8 +232,9 @@ not required for catalog browsing or BlackBox updates. The PS5 was previously identified as `192.168.10.26`; requests from `192.168.10.6` seen at that time were from the operator's own workstation, not a console, before the consoles were moved onto VLAN 40. All `192.168.10.0/24` -addresses are historical and must not be used as the current payload destination; -with `ALLOWED_CLIENTS` set to `192.168.40.0/28` they can no longer query the gateway. +addresses are historical and must not be used as the current payload destination, +though `192.168.10.0/27` remains allowed as the trusted management range for +operator testing. The PS5 ELF loader listens on TCP port `9021` after a successful exploit run. On 2026-10-01, a connection-only probe from `net-utils01` to diff --git a/docs/PS5_SETUP.md b/docs/PS5_SETUP.md index e6ba7e2..ce8fe82 100644 --- a/docs/PS5_SETUP.md +++ b/docs/PS5_SETUP.md @@ -147,9 +147,9 @@ O Compose inclui um DNS controlado no `net-utils01` que: Manager, Spectrum Library e BlackBox; - devolva `NXDOMAIN` para todos os restantes nomes, mantendo PSN, updates e telemetria bloqueados por DNS; -- responda apenas a clientes na VLAN das consolas (`192.168.40.0/28` por - defeito, via `ALLOWED_CLIENTS`), descartando consultas de qualquer outra - origem; +- responda apenas a clientes nas redes permitidas (por defeito, via + `ALLOWED_CLIENTS`: consolas `192.168.40.0/28`, servers `192.168.20.0/24` e + gestão `192.168.10.0/27`), descartando consultas de qualquer outra origem; - registe as consultas nos logs do container; - apresente um gateway HTTPS local e redirecione o browser para o exploit em `http://192.168.20.30:8000/`. @@ -177,9 +177,11 @@ não um hostname. A firewall deve permitir UDP e TCP `53` de `net-utils01` para resolvedor. A consola continua a precisar apenas de UDP/TCP `53` para `192.168.20.30`; não deve consultar diretamente um DNS público. -O gateway só responde a consultas DNS vindas das redes listadas em `ALLOWED_CLIENTS` -(por defeito `192.168.40.0/28`, a VLAN das consolas). O valor aceita uma lista -separada por vírgulas de endereços individuais e/ou intervalos CIDR — por exemplo, +O gateway só responde a consultas DNS vindas das redes listadas em `ALLOWED_CLIENTS`. +Por defeito inclui a VLAN das consolas `192.168.40.0/28`, a VLAN de servers +`192.168.20.0/24` e a VLAN de gestão/confiança `192.168.10.0/27` (estas duas últimas +para o operador poder testar e administrar). O valor aceita uma lista separada por +vírgulas de endereços individuais e/ou intervalos CIDR — por exemplo, `192.168.40.13,192.168.40.14` para trancar apenas às duas PS5 autorizadas (PS5FAT e PS5PRO). Um valor vazio desativa o filtro e serve todos os clientes. Consultas de origens não permitidas são descartadas e registadas como `denied`.