novox/hq
3
0
Fork 0
Code Issues 5 Pull Requests 5 Releases Wiki Activity

Issue 196: the hub relays the mesh only on the ports it publishes itself #276

Merged
mesh-admin merged 2 commits from jschoubben/the-hub-relays-the-mesh AGit into main 2026-10-02 09:23:56 +00:00
Conversation 0 Commits 2 Files Changed 2
+9 -2
1 changed files with 9 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit d05ac367f1 - Show all commits
04-ISSUES/196-the-hub-relays-only-the-ports-it-publishes-itself/00-report.md
+9 -2
View File
@@ -1,8 +1,8 @@
--- ---
status: located status: resolved
opened: 2026-10-02 opened: 2026-10-02
located-in: [mesh-controller internal/catalogue/filtering.go (AsNftables: the forward chain has no rule for the mesh passing through, so a relayed packet is judged by this machine's own published ports)] located-in: [mesh-controller internal/catalogue/filtering.go (AsNftables: the forward chain has no rule for the mesh passing through, so a relayed packet is judged by this machine's own published ports)]
fixed-by: fixed-by: mesh-controller PR 209 (the forward chain relays what comes in and goes out on the tunnel), live 2026-10-02
amended-design: [] amended-design: []
--- ---
@@ -45,3 +45,10 @@ same day, and that explanation fit well enough that the per-port pattern was not
mesh? That would duplicate the target's rules on the hub. mesh? That would duplicate the target's rules on the hub.
- No test raises two machines behind a hub and checks a port between them that the hub does not - No test raises two machines behind a hub and checks a port between them that the hub does not
publish. The lab's beds have one machine per site. publish. The lab's beds have one machine per site.
## Resolved (2026-10-02)
Live on all four machines after one push each. The same sweep, from both home machines to the third
over the mesh: 45 of 55 ports answer, the same 45 the hub reaches directly. The 9 that do not are
ports the target opens to nobody on the mesh, and one is refused because it listens only on a LAN
address. Nothing answers that the target's rules do not open.