TinyBacklog/relapse-exploit-docker
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Document VLAN-wide firewall fix for console DNS

Browse Source 
The inter-VLAN allow rules were scoped to 192.168.40.14 only, so the PS5 Payload
Manager on 192.168.40.13 (PS5FAT) could not reach the DNS gateway and every
catalog sync failed with "Could not resolve hostname". Broadening the rules to
the console VLAN 192.168.40.0/28 (UDP/TCP 53 plus 80/443/8000) fixed it. Update
the firewall table to the /28 and record the diagnosis.

Co-Authored-By: Claude Opus 4.8 <[email protected]>
This commit is contained in:
kadinho
2026-10-11 15:23:13 +01:00
co-authored by Claude Opus 4.8
parent 4c22f8addf
commit d106eaab95
1 changed files with 14 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/HANDOFF.md
+14 -5
View File
@@ -276,11 +276,20 @@ The inter-VLAN firewall policy reported as configured is:
| Source | Destination | Protocol/port | Purpose/state |
| --- | --- | --- | --- |
| `net-utils01` (`192.168.20.30`) | PS5 (`192.168.40.14`) | TCP `9021` | payload manager to ELF loader; active |
| PS5 (`192.168.40.14`) | `net-utils01` (`192.168.20.30`) | TCP `80`, `443`, `8000`; UDP/TCP `53` | Relapse page, User Guide gateway and restricted DNS; active |
| PS5 (`192.168.40.14`) | `net-utils01` (`192.168.20.30`) | TCP `8001` | reserved for payload-manager phase 5; enable only during that phase |
| PS5 (`192.168.40.14`) | remaining `192.168.20.0/24` hosts | all | blocked |
| hosts other than `net-utils01` | PS5 (`192.168.40.14`) | TCP `9021` | blocked |
| `net-utils01` (`192.168.20.30`) | consoles (`192.168.40.0/28`) | TCP `9021` | payload manager to ELF loader; active |
| consoles (`192.168.40.0/28`) | `net-utils01` (`192.168.20.30`) | TCP `80`, `443`, `8000`; UDP/TCP `53` | Relapse page, User Guide gateway and restricted DNS; active |
| consoles (`192.168.40.0/28`) | `net-utils01` (`192.168.20.30`) | TCP `8001` | reserved for payload-manager phase 5; enable only during that phase |
| consoles (`192.168.40.0/28`) | remaining `192.168.20.0/24` hosts | all | blocked |
| hosts other than `net-utils01` | consoles (`192.168.40.0/28`) | TCP `9021` | blocked |
The console-side allow rules were originally scoped to `192.168.40.14` only. On
2026-10-11 the PS5 Payload Manager on `192.168.40.13` (PS5FAT) failed every
catalog sync with "Could not resolve hostname"; the gateway logged zero DNS
queries from VLAN 40, proving the console's DNS packets never reached
`192.168.20.30`. Broadening these rules from the single `/32` to the console VLAN
`192.168.40.0/28` fixed it, and both consoles now resolve. Keep the source scoped
to the `/28`, not wider. The UDP `53` leg is essential: the manager's libcurl
resolves over UDP first, so a TCP-only rule reproduces the same failure.
The specific allow rules must be evaluated before the broader deny rules. Keep
TCP `8001` disabled until phase 5 has a reviewed service that requires it. The