kyleandClaude Sonnet 5.5
880bdd3f44
ROS never leaves the robot, by the owner's decision: the firewall drops domain 42's DDS ports on every interface but loopback (usb0 included), discovery is pinned to LOCALHOST, and hermes_mcp is the only bridge to the outside. PipeWire 1.0.5 runs as hermes's user services with its network server on TCP 4713; the firewall, loaded at boot before it, is the protection. Verified from talos: 4713 connects over usb0 and times out over Wi-Fi. CONTEXT.md brought up to date: the face service, gaze, recognition, the firewall, and what is left. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AFN8nRRCiDiMN7ChBpHJhs
22 lines
996 B
Plaintext
22 lines
996 B
Plaintext
#!/usr/sbin/nft -f
|
|
# The robot's audio (4713), MCP (8765) and face webhook (8766) ports are reachable only over the
|
|
# USB link, and only from the host at 10.55.0.1. Every other interface, Wi-Fi included, is dropped.
|
|
# ROS 2 never leaves the robot: its DDS has no authentication, and /camera/* and /vision/faces
|
|
# carry video and recognised names. Domain 42's ports (17900-18149 with Fast DDS's default offsets)
|
|
# are dropped on every interface but loopback, usb0 included. The only way in or out is hermes_mcp,
|
|
# which talks to the ROS graph locally and to the host over MCP.
|
|
# SSH and everything else are left alone: that policy is the owner's call.
|
|
|
|
table inet robot
|
|
delete table inet robot
|
|
|
|
table inet robot {
|
|
chain input {
|
|
type filter hook input priority 0; policy accept;
|
|
iif "lo" accept
|
|
iifname "usb0" ip saddr 10.55.0.1 tcp dport { 4713, 8765, 8766 } accept
|
|
tcp dport { 4713, 8765, 8766 } drop
|
|
iifname != "lo" udp dport 17900-18149 drop
|
|
}
|
|
}
|