From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4hTpjm6Fd4z36WX for ; Tue, 25 Aug 2026 13:37:16 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [IPv6:2001:678:b28::25]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1 raw public key) server-digest SHA384 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mail01.haj.ipfire.org", Issuer "YR2" (not verified)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4hTpjj2xYYz2xKC for ; Tue, 25 Aug 2026 13:37:13 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4hTpjX1rQMz3pP; Tue, 25 Aug 2026 13:37:04 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1787665024; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=WKJ0ckNrcR+QfLizuMdGgq7XRL0dgsQbrH/+dfQqcWU=; b=HaixOJPExfIHSu/SyAhseCRW4rRHbFpyB5/q7oh++BGCrhkhFkCFFqJaXHLiqvAiqVz/Ny GliKzlQCP/As9lBQ== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1787665024; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=WKJ0ckNrcR+QfLizuMdGgq7XRL0dgsQbrH/+dfQqcWU=; b=IQFbPA9DcbgiAjVrnVe7Ngz5tDJ5Jnkv503Mp8MFY2r7rv4vHXle//lhpNxsj9Bv8Gm689 dqBLiV5Afxul8wzZJfCiunHBo18M2imvsOsfccndZYS6e8g2ntF383ruzuISKTHpxd8Wvh 8DgeO8nnqg8XMU6kkGsDAcnPaTRmsL1t3+whSASLTEY+Fbajso1TJyaRVMBBAIoItfK7Rh okURlpcP3GmY0WetFmgB2/InfwUcnWpcpiuPdIW1qy9Bs+QdXg4GS/xKXPJj01p+PscRm7 zJLLdG/kTt5cQ4wI+NTt7Qlpw3WlkYE8DMclKX+jOWg8o0oazpd+Wdq/SAof7g== Content-Type: text/plain; charset=utf-8 Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: Mime-Version: 1.0 Subject: Re: [PATCH] firewall: Restrict outgoing network access for Knot to DNS-related ports From: Michael Tremer In-Reply-To: <8455e819-c886-45e5-88c7-d4c47e941df5@ipfire.org> Date: Tue, 25 Aug 2026 14:37:03 +0100 Cc: "IPFire: Development" Content-Transfer-Encoding: quoted-printable Message-Id: <04EC2F7A-3A82-4E96-859E-7DCE447E3F2F@ipfire.org> References: <8455e819-c886-45e5-88c7-d4c47e941df5@ipfire.org> To: =?utf-8?Q?Peter_M=C3=BCller?= Hello, Thank you for this patch. Very sensible adjustment. Best, -Michael > On 25 Aug 2026, at 14:29, Peter M=C3=BCller = wrote: >=20 > Since Knot and the RPZ zone sync tool only need access to destination = ports > 53 (UDP + TCP) or 853 (TCP) in case of DNS over TLS, keep their = firewall > rules constrained to these ports. >=20 > Signed-off-by: Peter M=C3=BCller > --- > src/initscripts/system/firewall | 6 ++++-- > 1 file changed, 4 insertions(+), 2 deletions(-) >=20 > diff --git a/src/initscripts/system/firewall = b/src/initscripts/system/firewall > index a97758dc3..c7627bcab 100644 > --- a/src/initscripts/system/firewall > +++ b/src/initscripts/system/firewall > @@ -2,7 +2,7 @@ > = ##########################################################################= ##### > # = # > # IPFire.org - A linux based firewall = # > -# Copyright (C) 2007-2022 IPFire Team = # > +# Copyright (C) 2007-2026 IPFire Team = # > # = # > # This program is free software: you can redistribute it and/or modify = # > # it under the terms of the GNU General Public License as published by = # > @@ -443,7 +443,9 @@ iptables_init() { > /usr/local/bin/captivectrl >=20 > # Grant Knot Resolver access > - iptables -A LOCAL_OUTPUT -m owner --uid-owner knot-resolver -j = ACCEPT > + iptables -A LOCAL_OUTPUT -m owner --uid-owner knot-resolver -p udp = --dport 53 -j ACCEPT > + iptables -A LOCAL_OUTPUT -m owner --uid-owner knot-resolver -p tcp = --dport 53 -j ACCEPT > + iptables -A LOCAL_OUTPUT -m owner --uid-owner knot-resolver -p tcp = --dport 853 -j ACCEPT >=20 > # If a Tor relay is enabled apply firewall rules > if [ "${TOR_RELAY_ENABLED}" =3D "on" -a -n "${TOR_RELAY_PORT}" ]; then > --=20 > 2.51.0 >=20