[PATCH] firewall: Restrict outgoing network access for Knot to DNS-related ports

["Peter Müller" <peter.mueller@ipfire.org>]

Since Knot and the RPZ zone sync tool only need access to destination ports
53 (UDP + TCP) or 853 (TCP) in case of DNS over TLS, keep their firewall
rules constrained to these ports.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
---
 src/initscripts/system/firewall | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/src/initscripts/system/firewall b/src/initscripts/system/firewall
index a97758dc3..c7627bcab 100644
--- a/src/initscripts/system/firewall
+++ b/src/initscripts/system/firewall
@@ -2,7 +2,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007-2022  IPFire Team  <info@ipfire.org>                     #
+# Copyright (C) 2007-2026  IPFire Team  <info@ipfire.org>                     #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -443,7 +443,9 @@ iptables_init() {
 	/usr/local/bin/captivectrl
 
 	# Grant Knot Resolver access
-	iptables -A LOCAL_OUTPUT -m owner --uid-owner knot-resolver -j ACCEPT
+	iptables -A LOCAL_OUTPUT -m owner --uid-owner knot-resolver -p udp --dport  53 -j ACCEPT
+	iptables -A LOCAL_OUTPUT -m owner --uid-owner knot-resolver -p tcp --dport  53 -j ACCEPT
+	iptables -A LOCAL_OUTPUT -m owner --uid-owner knot-resolver -p tcp --dport 853 -j ACCEPT
 
 	# If a Tor relay is enabled apply firewall rules
 	if [ "${TOR_RELAY_ENABLED}" = "on" -a -n "${TOR_RELAY_PORT}" ]; then
-- 
2.51.0