The inter-VLAN allow rules were scoped to 192.168.40.14 only, so the PS5 Payload
Manager on 192.168.40.13 (PS5FAT) could not reach the DNS gateway and every
catalog sync failed with "Could not resolve hostname". Broadening the rules to
the console VLAN 192.168.40.0/28 (UDP/TCP 53 plus 80/443/8000) fixed it. Update
the firewall table to the /28 and record the diagnosis.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
Serve only A/ANY queries; answer AAAA and all other record types with NOERROR and
no data, for overrides and forwarded names alike. The console LAN has no IPv6
route, so returning a real AAAA made clients stall on an unreachable address.
This fixes the PS5 Payload Manager looping on "synchronizing repositories": its
dual-stack catalog host itsplk.github.io handed back an IPv6 address and the
manager's libcurl download (no timeout) hung on it indefinitely.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
Replace the gateway's env-var DNS policy with docker/nanodns.ini, modelled on
https://github.com/drakmor/nanoDNS#config: [general] (redirect_url,
allowed_clients), [upstream] (ordered resolver list + timeout_ms), [overrides]
(mask = IPv4 spoof) and [exceptions] (masks forwarded upstream). Masks use
shell-style wildcards and match case-insensitively; resolution order is
exceptions -> overrides -> NXDOMAIN.
The unmatched-name behaviour is deliberately inverted from upstream nanoDNS:
names matching no rule return NXDOMAIN (default-deny) instead of being forwarded,
so PSN, updates and telemetry stay blocked. The source-client allowlist now lives
in [general] allowed_clients. The INI is baked into the image; CONFIG_FILE can
point at a mounted file for per-host overrides.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
Broaden ALLOWED_CLIENTS from the console VLAN alone to also include the server
VLAN (192.168.20.0/24) and the trusted management VLAN (192.168.10.0/27) so the
resolver can be tested and administered from those networks. The consoles still
only require the 192.168.40.0/28 range.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
Add an ALLOWED_CLIENTS source-address filter to the DNS service so it only
answers queries from the authorized PS5 VLAN (192.168.40.0/28 by default).
Queries from any other source address are dropped and logged as "denied" on
both UDP and TCP. The value accepts a comma-separated mix of individual
addresses and CIDR ranges, and an empty value disables the filter.
Record the two authorized consoles (PS5PRO 192.168.40.14, PS5FAT
192.168.40.13) and the stale 192.168.10.x workstation address in the docs.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
kadinhoandClaude Opus 4.8