From 57bcd53b14e1f795aa94b079c463d41ba8c02e94 Mon Sep 17 00:00:00 2001 From: Your Name Date: Fri, 29 May 2026 00:28:27 +0530 Subject: fix(firewall): remove blanket TCP allow for unpaid clients The sandbox_mint_access=true default allowed ALL TCP forwarding from unpaid clients, completely bypassing the firewall. Fix: - Remove the blanket TCP allow when sandbox_mint_access is set - Only allow traffic to AP IP on specific ports (80, 2121, 4869, mining) - Allow ICMP to AP IP for diagnostics - Default sandbox_mint_access to false - Add port 4869 (local relay) to allowed sandbox ports Verified on Board B: unpaid clients blocked from internet, local services (portal, API, relay) still accessible. --- main/config.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'main') diff --git a/main/config.c b/main/config.c index 2edb6da..d2c40d6 100644 --- a/main/config.c +++ b/main/config.c @@ -45,7 +45,7 @@ esp_err_t tollgate_config_init(void) g_config.mining_payout_mode = MINING_PAYOUT_AUTO; g_config.stratum_port = 3333; g_config.mining_port = 3334; - g_config.mining_sandbox_mint_access = true; + g_config.mining_sandbox_mint_access = false; g_config.market_enabled = true; g_config.market_scan_interval_s = 30; g_config.client_auto_switch = false; -- cgit v1.2.3