nik/homelab
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: allow WireGuard road-warrior clients to reach DNS on minisforum
Some checks failed
validate / lint (push) Failing after 2s
Details

Browse Source 
UFW allowed 53/udp+tcp from every other internal subnet but not from
10.10.0.0/24 (the WireGuard client subnet), so once the tunnel itself
was reachable, decrypted DNS queries still got dropped at minisforum's
own INPUT chain before reaching Technitium.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
Nik Afiq 2026-08-26 20:45:09 +09:00
parent b37a816b3e
commit 8629a36278
1 changed files with 2 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
ansible/roles/common/defaults/main.yaml
View File

@ -25,6 +25,8 @@ ufw_allowed_ports:
- { port: 6443, proto: tcp, comment: K3s API server } - { port: 6443, proto: tcp, comment: K3s API server }
- { port: 10250, proto: tcp, comment: Kubelet, src: 10.10.40.0/24 } - { port: 10250, proto: tcp, comment: Kubelet, src: 10.10.40.0/24 }
- { port: 8472, proto: udp, comment: Flannel VXLAN, src: 10.10.40.0/24 } - { port: 8472, proto: udp, comment: Flannel VXLAN, src: 10.10.40.0/24 }
- { port: 53, proto: udp, comment: WireGuard road-warrior DNS, src: 10.10.0.0/24 }
- { port: 53, proto: tcp, comment: WireGuard road-warrior DNS, src: 10.10.0.0/24 }
data_dirs: data_dirs:
- /data/gitea - /data/gitea