Allow server and management VLANs to query the DNS

Broaden ALLOWED_CLIENTS from the console VLAN alone to also include the server
VLAN (192.168.20.0/24) and the trusted management VLAN (192.168.10.0/27) so the
resolver can be tested and administered from those networks. The consoles still
only require the 192.168.40.0/28 range.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

compose.yaml

@@ -22,7 +22,7 @@ services:
       REDIRECT_URL: "${GUIDE_REDIRECT_URL:-http://192.168.20.30:8000/}"
       FORWARDED_DOMAINS: "${FORWARDED_DOMAINS:-homebrew.page,itsplk.github.io,store.spectrumlibrary.online,api.github.com,github.com,raw.githubusercontent.com,release-assets.githubusercontent.com,prosperopatches.com,cdn.prosperopatches.com,image.api.playstation.com,gmedia.playstation.com}"
       UPSTREAM_DNS: "${UPSTREAM_DNS:-1.1.1.1}"
-      ALLOWED_CLIENTS: "${ALLOWED_CLIENTS:-192.168.40.0/28}"
+      ALLOWED_CLIENTS: "${ALLOWED_CLIENTS:-192.168.40.0/28,192.168.20.0/24,192.168.10.0/27}"
     ports:
       - "${GATEWAY_BIND_IP:-192.168.20.30}:53:8053/udp"
       - "${GATEWAY_BIND_IP:-192.168.20.30}:53:8053/tcp"

docker/guide_gateway.py

@@ -26,12 +26,16 @@ FORWARDED_DOMAINS = frozenset(
 )
 UPSTREAM_DNS = str(ipaddress.ip_address(os.environ.get("UPSTREAM_DNS", "1.1.1.1")))
 UPSTREAM_TIMEOUT = 3.0
-# Source networks allowed to query the DNS service (PS5 VLAN by default).
+# Source networks allowed to query the DNS service. Defaults to the console VLAN
-# Accepts comma-separated individual addresses and CIDR ranges; empty disables
+# plus the server and trusted-management VLANs. Accepts a comma-separated mix of
-# the filter and serves every client.
+# individual addresses and CIDR ranges; empty disables the filter and serves
+# every client.
 ALLOWED_CLIENTS = tuple(
     ipaddress.ip_network(entry.strip(), strict=False)
-    for entry in os.environ.get("ALLOWED_CLIENTS", "192.168.40.0/28").split(",")
+    for entry in os.environ.get(
+        "ALLOWED_CLIENTS",
+        "192.168.40.0/28,192.168.20.0/24,192.168.10.0/27",
+    ).split(",")
     if entry.strip()
 )
 CERTIFICATE = "/srv/certificates/manuals.crt"

docs/HANDOFF.md

@@ -194,12 +194,14 @@ sends DNS only to `net-utils01`; that host must be allowed to reach the configur
 upstream resolver on UDP/TCP 53.
 
 The gateway additionally restricts which source clients it answers. `ALLOWED_CLIENTS`
-defaults to the console VLAN `192.168.40.0/28`; queries from any other source address
+defaults to the console VLAN `192.168.40.0/28`, the server VLAN `192.168.20.0/24`,
-are dropped and logged as `denied`, on both UDP and TCP. The value accepts a
+and the trusted management VLAN `192.168.10.0/27`; queries from any other source
-comma-separated mix of individual addresses and CIDR ranges, and an empty value
+address are dropped and logged as `denied`, on both UDP and TCP. The server and
-disables the filter. This keeps the service dedicated to the two authorized consoles
+trusted VLANs are included so operators can test and administer the resolver; the
-and prevents other LAN hosts from using it as an open resolver for the allowlisted
+consoles themselves only need the `/28`. The value accepts a comma-separated mix of
-names.
+individual addresses and CIDR ranges, and an empty value disables the filter. This
+keeps the service off the rest of the LAN and prevents arbitrary hosts from using it
+as an open resolver for the allowlisted names.
 
 The Payload Manager review used upstream commit
 `e4e72dc9d831dd09ee8fabc222ad1e7f5139050e` and the official catalog current on
@@ -230,8 +232,9 @@ not required for catalog browsing or BlackBox updates.
 The PS5 was previously identified as `192.168.10.26`; requests from
 `192.168.10.6` seen at that time were from the operator's own workstation, not a
 console, before the consoles were moved onto VLAN 40. All `192.168.10.0/24`
-addresses are historical and must not be used as the current payload destination;
+addresses are historical and must not be used as the current payload destination,
-with `ALLOWED_CLIENTS` set to `192.168.40.0/28` they can no longer query the gateway.
+though `192.168.10.0/27` remains allowed as the trusted management range for
+operator testing.
 
 The PS5 ELF loader listens on TCP port `9021` after a successful exploit run. On
 2026-10-01, a connection-only probe from `net-utils01` to

docs/PS5_SETUP.md

@@ -147,9 +147,9 @@ O Compose inclui um DNS controlado no `net-utils01` que:
   Manager, Spectrum Library e BlackBox;
 - devolva `NXDOMAIN` para todos os restantes nomes, mantendo PSN, updates e
   telemetria bloqueados por DNS;
-- responda apenas a clientes na VLAN das consolas (`192.168.40.0/28` por
+- responda apenas a clientes nas redes permitidas (por defeito, via
-  defeito, via `ALLOWED_CLIENTS`), descartando consultas de qualquer outra
+  `ALLOWED_CLIENTS`: consolas `192.168.40.0/28`, servers `192.168.20.0/24` e
-  origem;
+  gestão `192.168.10.0/27`), descartando consultas de qualquer outra origem;
 - registe as consultas nos logs do container;
 - apresente um gateway HTTPS local e redirecione o browser para o exploit em
   `http://192.168.20.30:8000/`.
@@ -177,9 +177,11 @@ não um hostname. A firewall deve permitir UDP e TCP `53` de `net-utils01` para
 resolvedor. A consola continua a precisar apenas de UDP/TCP `53` para
 `192.168.20.30`; não deve consultar diretamente um DNS público.
 
-O gateway só responde a consultas DNS vindas das redes listadas em `ALLOWED_CLIENTS`
+O gateway só responde a consultas DNS vindas das redes listadas em `ALLOWED_CLIENTS`.
-(por defeito `192.168.40.0/28`, a VLAN das consolas). O valor aceita uma lista
+Por defeito inclui a VLAN das consolas `192.168.40.0/28`, a VLAN de servers
-separada por vírgulas de endereços individuais e/ou intervalos CIDR — por exemplo,
+`192.168.20.0/24` e a VLAN de gestão/confiança `192.168.10.0/27` (estas duas últimas
+para o operador poder testar e administrar). O valor aceita uma lista separada por
+vírgulas de endereços individuais e/ou intervalos CIDR — por exemplo,
 `192.168.40.13,192.168.40.14` para trancar apenas às duas PS5 autorizadas (PS5FAT e
 PS5PRO). Um valor vazio desativa o filtro e serve todos os clientes. Consultas de
 origens não permitidas são descartadas e registadas como `denied`.