[PATCH server-haj002] init_net: Allow incoming traffic from the master namespace

[PATCH server-haj002] init_net: Allow incoming traffic from the master namespace

[Ammar Faizi]

When spawning a shell in the master namespace, I can't perform DNS
requests because the systemd-resolved lives in the default namespace.
This requires the DNS resolver in /etc/resolv.conf to be changed to
10.3.3.2, then the default namespace has to allow DNS query traffics
from 10.3.3.1.

Let's just completely allow internal source network within CIDR source
address 10.3.3.0/24.

Signed-off-by: Ammar Faizi <ammarfaizi2@gnuweeb.org>
---

index 2c26319..404e79b 100755
--- a/init_net.sh
+++ b/init_net.sh
@@ -54,6 +54,7 @@ iptables -t filter -X;
 iptables -t filter -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT;
 iptables -t filter -A INPUT -p tcp -m multiport --dports 80,443,48588 -j ACCEPT;
 iptables -t filter -A INPUT -p icmp -j ACCEPT;
+iptables -t filter -A INPUT -s 10.3.3.0/24 -j ACCEPT;
 iptables -t filter -A INPUT -i lo -j ACCEPT;
 iptables -t filter -P INPUT DROP;
 
-- 
Ammar Faizi

Re: [PATCH server-haj002] init_net: Allow incoming traffic from the master namespace

[Alviro Iskandar Setiawan]

On Tue, Jul 4, 2023 at 4:47 AM Ammar Faizi wrote:
> When spawning a shell in the master namespace, I can't perform DNS
> requests because the systemd-resolved lives in the default namespace.
> This requires the DNS resolver in /etc/resolv.conf to be changed to
> 10.3.3.2, then the default namespace has to allow DNS query traffics
> from 10.3.3.1.
>
> Let's just completely allow internal source network within CIDR source
> address 10.3.3.0/24.
>
> Signed-off-by: Ammar Faizi <ammarfaizi2@gnuweeb.org>

applied, tq

-- Viro