From d106eaab953aa3e460e1c803e024916f06b54f91 Mon Sep 17 00:00:00 2001 From: kadinho Date: Sun, 11 Oct 2026 15:23:13 +0100 Subject: [PATCH] Document VLAN-wide firewall fix for console DNS The inter-VLAN allow rules were scoped to 192.168.40.14 only, so the PS5 Payload Manager on 192.168.40.13 (PS5FAT) could not reach the DNS gateway and every catalog sync failed with "Could not resolve hostname". Broadening the rules to the console VLAN 192.168.40.0/28 (UDP/TCP 53 plus 80/443/8000) fixed it. Update the firewall table to the /28 and record the diagnosis. Co-Authored-By: Claude Opus 4.8 --- docs/HANDOFF.md | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-) diff --git a/docs/HANDOFF.md b/docs/HANDOFF.md index f97dae5..62d0eb8 100644 --- a/docs/HANDOFF.md +++ b/docs/HANDOFF.md @@ -276,11 +276,20 @@ The inter-VLAN firewall policy reported as configured is: | Source | Destination | Protocol/port | Purpose/state | | --- | --- | --- | --- | -| `net-utils01` (`192.168.20.30`) | PS5 (`192.168.40.14`) | TCP `9021` | payload manager to ELF loader; active | -| PS5 (`192.168.40.14`) | `net-utils01` (`192.168.20.30`) | TCP `80`, `443`, `8000`; UDP/TCP `53` | Relapse page, User Guide gateway and restricted DNS; active | -| PS5 (`192.168.40.14`) | `net-utils01` (`192.168.20.30`) | TCP `8001` | reserved for payload-manager phase 5; enable only during that phase | -| PS5 (`192.168.40.14`) | remaining `192.168.20.0/24` hosts | all | blocked | -| hosts other than `net-utils01` | PS5 (`192.168.40.14`) | TCP `9021` | blocked | +| `net-utils01` (`192.168.20.30`) | consoles (`192.168.40.0/28`) | TCP `9021` | payload manager to ELF loader; active | +| consoles (`192.168.40.0/28`) | `net-utils01` (`192.168.20.30`) | TCP `80`, `443`, `8000`; UDP/TCP `53` | Relapse page, User Guide gateway and restricted DNS; active | +| consoles (`192.168.40.0/28`) | `net-utils01` (`192.168.20.30`) | TCP `8001` | reserved for payload-manager phase 5; enable only during that phase | +| consoles (`192.168.40.0/28`) | remaining `192.168.20.0/24` hosts | all | blocked | +| hosts other than `net-utils01` | consoles (`192.168.40.0/28`) | TCP `9021` | blocked | + +The console-side allow rules were originally scoped to `192.168.40.14` only. On +2026-10-11 the PS5 Payload Manager on `192.168.40.13` (PS5FAT) failed every +catalog sync with "Could not resolve hostname"; the gateway logged zero DNS +queries from VLAN 40, proving the console's DNS packets never reached +`192.168.20.30`. Broadening these rules from the single `/32` to the console VLAN +`192.168.40.0/28` fixed it, and both consoles now resolve. Keep the source scoped +to the `/28`, not wider. The UDP `53` leg is essential: the manager's libcurl +resolves over UDP first, so a TCP-only rule reproduces the same failure. The specific allow rules must be evaluated before the broader deny rules. Keep TCP `8001` disabled until phase 5 has a reviewed service that requires it. The