From 57bcd53b14e1f795aa94b079c463d41ba8c02e94 Mon Sep 17 00:00:00 2001 From: Your Name Date: Fri, 29 May 2026 00:28:27 +0530 Subject: fix(firewall): remove blanket TCP allow for unpaid clients The sandbox_mint_access=true default allowed ALL TCP forwarding from unpaid clients, completely bypassing the firewall. Fix: - Remove the blanket TCP allow when sandbox_mint_access is set - Only allow traffic to AP IP on specific ports (80, 2121, 4869, mining) - Allow ICMP to AP IP for diagnostics - Default sandbox_mint_access to false - Add port 4869 (local relay) to allowed sandbox ports Verified on Board B: unpaid clients blocked from internet, local services (portal, API, relay) still accessible. --- components/tollgate_core/src/tollgate_core_firewall.c | 12 +++++------- main/config.c | 2 +- 2 files changed, 6 insertions(+), 8 deletions(-) diff --git a/components/tollgate_core/src/tollgate_core_firewall.c b/components/tollgate_core/src/tollgate_core_firewall.c index 4f12923..5dbdc7a 100644 --- a/components/tollgate_core/src/tollgate_core_firewall.c +++ b/components/tollgate_core/src/tollgate_core_firewall.c @@ -18,7 +18,6 @@ static const char *TAG = "tg_core_fw"; static esp_ip4_addr_t s_ap_ip; static uint16_t s_mining_port = 3333; -static bool s_sandbox_mint_access = false; typedef struct { uint32_t ip; @@ -81,7 +80,7 @@ void tollgate_core_fw_set_sandbox_ports(uint16_t mining_port) void tollgate_core_fw_set_sandbox_mint_access(bool enabled) { - s_sandbox_mint_access = enabled; + (void)enabled; } static bool is_sandbox_allowed(struct pbuf *p) @@ -98,17 +97,16 @@ static bool is_sandbox_allowed(struct pbuf *p) struct tcp_hdr *tcphdr = (struct tcp_hdr *)((uint8_t *)p->payload + IP_HLEN); dst_port = lwip_ntohs(tcphdr->dest); } - if (dst_port == 80 || dst_port == 2121 || dst_port == s_mining_port) { + if (dst_port == 80 || dst_port == 2121 || dst_port == 4869 || dst_port == s_mining_port) { return true; } } if (iphdr->_proto == IP_PROTO_UDP) { return true; } - } - - if (s_sandbox_mint_access && iphdr->_proto == IP_PROTO_TCP) { - return true; + if (iphdr->_proto == 1) { + return true; + } } return false; diff --git a/main/config.c b/main/config.c index 2edb6da..d2c40d6 100644 --- a/main/config.c +++ b/main/config.c @@ -45,7 +45,7 @@ esp_err_t tollgate_config_init(void) g_config.mining_payout_mode = MINING_PAYOUT_AUTO; g_config.stratum_port = 3333; g_config.mining_port = 3334; - g_config.mining_sandbox_mint_access = true; + g_config.mining_sandbox_mint_access = false; g_config.market_enabled = true; g_config.market_scan_interval_s = 30; g_config.client_auto_switch = false; -- cgit v1.2.3