kyleandClaude Sonnet 5.5
dba756f3a6
DDS has no authentication, and /camera/* and /vision/faces carry video and
recognised names. Discovery now defaults to this machine only
(ROBOT_ROS_DISCOVERY=SUBNET to opt in; a ${VAR:-default} on ROS's own variable
never applied, since its setup script already exports SUBNET), and the firewall
drops domain 42's DDS ports on every interface but usb0 and loopback. The
detector's startup log prints a count of enrolled people, not their names.
robot-firewall.service loads the rules before networking at every boot: they had
only been loaded at runtime and were gone after each reboot, which has to be fixed
before the PipeWire network server opens port 4713.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AFN8nRRCiDiMN7ChBpHJhs
21 lines
883 B
Plaintext
21 lines
883 B
Plaintext
#!/usr/sbin/nft -f
|
|
# The robot's audio (4713), MCP (8765) and face webhook (8766) ports are reachable only over the
|
|
# USB link, and only from the host at 10.55.0.1. Every other interface, Wi-Fi included, is dropped.
|
|
# ROS 2's DDS has no authentication, and /camera/* and /vision/faces carry video and recognised
|
|
# names, so its ports (domain 42: 17900-18149 with Fast DDS's default offsets) are dropped on every
|
|
# interface but usb0 and loopback too.
|
|
# SSH and everything else are left alone: that policy is the owner's call.
|
|
|
|
table inet robot
|
|
delete table inet robot
|
|
|
|
table inet robot {
|
|
chain input {
|
|
type filter hook input priority 0; policy accept;
|
|
iif "lo" accept
|
|
iifname "usb0" ip saddr 10.55.0.1 tcp dport { 4713, 8765, 8766 } accept
|
|
tcp dport { 4713, 8765, 8766 } drop
|
|
iifname != { "lo", "usb0" } udp dport 17900-18149 drop
|
|
}
|
|
}
|