kyleandClaude Sonnet 5.5
2535344f3d
Audio (4713), MCP (8765) and the face webhook (8766) are accepted only on usb0 from 10.55.0.1 and dropped on every other interface, Wi-Fi included. SSH is left open on all interfaces for V2, by the owner's decision. Tested on the Pi with throwaway listeners: 8765 answers over usb0 and is unreachable over Wi-Fi, while a control port answers on both. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AFN8nRRCiDiMN7ChBpHJhs
17 lines
585 B
Plaintext
17 lines
585 B
Plaintext
#!/usr/sbin/nft -f
|
|
# The robot's audio (4713), MCP (8765) and face webhook (8766) ports are reachable only over the
|
|
# USB link, and only from the host at 10.55.0.1. Every other interface, Wi-Fi included, is dropped.
|
|
# SSH and everything else are left alone: that policy is the owner's call.
|
|
|
|
table inet robot
|
|
delete table inet robot
|
|
|
|
table inet robot {
|
|
chain input {
|
|
type filter hook input priority 0; policy accept;
|
|
iif "lo" accept
|
|
iifname "usb0" ip saddr 10.55.0.1 tcp dport { 4713, 8765, 8766 } accept
|
|
tcp dport { 4713, 8765, 8766 } drop
|
|
}
|
|
}
|