X-Git-Url: https://iankelling.org/git/?p=distro-setup;a=blobdiff_plain;f=transmission-firewall%2Fnetns.rules;h=96b404f9251425a6fe69d08f7bc1891342937541;hp=f0a37f774e1cf5d8808f14d245aace419b5e0b45;hb=2cff2dd2b8040e6cbd721932ae09142881d7e0a6;hpb=b857462732e15f455e41f26e3048a390d7b399c0

diff --git a/transmission-firewall/netns.rules b/transmission-firewall/netns.rules
index f0a37f7..96b404f 100644
--- a/transmission-firewall/netns.rules
+++ b/transmission-firewall/netns.rules
@@ -1,3 +1,7 @@
+# note, transmission specific thing here is to
+# allow one extra port for transmission-remote, but thats no big deal,
+# might as well use this in general for openvpn-nn
+
 # format from iptables-save. [0:0] are comments of packet-count/byte-count
 # which I removed
 *filter
@@ -7,7 +11,7 @@
 # from ip route, we can deduce that traffic goes to the
 # local 10.8.0.x tun0, then to the normal interface.
 # For the normal interface, we allow only some ports:
-# dns, vpn, transmission-remote.
+# dns for root user, vpn, and transmission-remote.
 # dns is only used to resolve the vpn server ip on initial
 # connection.
 # rules are mirror on input and output, just for extra safety,
@@ -29,6 +33,7 @@
 -A OUTPUT -p tcp -m tcp --dport 53 -m owner --uid-owner root -j ACCEPT
 -A INPUT -p tcp -m tcp --sport 53 -j ACCEPT
 
+# transmission-remote
 -A OUTPUT -p tcp -m tcp --sport 9091 -j ACCEPT
 -A INPUT -p tcp -m tcp --dport 9091 -j ACCEPT