From 57bcd53b14e1f795aa94b079c463d41ba8c02e94 Mon Sep 17 00:00:00 2001 From: Your Name Date: Fri, 29 May 2026 00:28:27 +0530 Subject: fix(firewall): remove blanket TCP allow for unpaid clients The sandbox_mint_access=true default allowed ALL TCP forwarding from unpaid clients, completely bypassing the firewall. Fix: - Remove the blanket TCP allow when sandbox_mint_access is set - Only allow traffic to AP IP on specific ports (80, 2121, 4869, mining) - Allow ICMP to AP IP for diagnostics - Default sandbox_mint_access to false - Add port 4869 (local relay) to allowed sandbox ports Verified on Board B: unpaid clients blocked from internet, local services (portal, API, relay) still accessible. --- components/tollgate_core/src/tollgate_core_firewall.c | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) (limited to 'components') diff --git a/components/tollgate_core/src/tollgate_core_firewall.c b/components/tollgate_core/src/tollgate_core_firewall.c index 4f12923..5dbdc7a 100644 --- a/components/tollgate_core/src/tollgate_core_firewall.c +++ b/components/tollgate_core/src/tollgate_core_firewall.c @@ -18,7 +18,6 @@ static const char *TAG = "tg_core_fw"; static esp_ip4_addr_t s_ap_ip; static uint16_t s_mining_port = 3333; -static bool s_sandbox_mint_access = false; typedef struct { uint32_t ip; @@ -81,7 +80,7 @@ void tollgate_core_fw_set_sandbox_ports(uint16_t mining_port) void tollgate_core_fw_set_sandbox_mint_access(bool enabled) { - s_sandbox_mint_access = enabled; + (void)enabled; } static bool is_sandbox_allowed(struct pbuf *p) @@ -98,17 +97,16 @@ static bool is_sandbox_allowed(struct pbuf *p) struct tcp_hdr *tcphdr = (struct tcp_hdr *)((uint8_t *)p->payload + IP_HLEN); dst_port = lwip_ntohs(tcphdr->dest); } - if (dst_port == 80 || dst_port == 2121 || dst_port == s_mining_port) { + if (dst_port == 80 || dst_port == 2121 || dst_port == 4869 || dst_port == s_mining_port) { return true; } } if (iphdr->_proto == IP_PROTO_UDP) { return true; } - } - - if (s_sandbox_mint_access && iphdr->_proto == IP_PROTO_TCP) { - return true; + if (iphdr->_proto == 1) { + return true; + } } return false; -- cgit v1.2.3