asusmini: open 5555/5556/6555/3030 to the LAN (CC edge Caddy on pve) #1

2026-09-28T00:41:35Z

boris commented

2026-09-28 00:41:35 +00:00

Commons Computer public edge is moving to a Caddy LXC on pve (192.168.1.11, CT 101) — UDM forwards 80/443 on 205.250.24.44 will re-point there (DNS unchanged; all four hostnames already resolve to .44).

The asusmini host firewall currently opens only 22/80/443 on the wired interface, so the edge cannot reach the service ports (probed: blocked from LAN, fine from tailnet). This PR allows the four service ports from 192.168.1.0/24 only.

pds.commonscomputer.com :5556
knot.commonscomputer.com :5555
spindle.commonscomputer.com :6555
automerge.commonscomputer.com :3030

Follow-up (separate PR, after the UDM flip): strip the public Caddy vhosts from this box + optionally drop 80/443 from allowedTCPPorts.

via hausgeist

Commons Computer public edge is moving to a **Caddy LXC on pve** (192.168.1.11, CT 101) — UDM forwards 80/443 on 205.250.24.44 will re-point there (DNS unchanged; all four hostnames already resolve to .44). The asusmini host firewall currently opens only 22/80/443 on the wired interface, so the edge cannot reach the service ports (probed: blocked from LAN, fine from tailnet). This PR allows the four service ports **from 192.168.1.0/24 only**. - pds.commonscomputer.com :5556 - knot.commonscomputer.com :5555 - spindle.commonscomputer.com :6555 - automerge.commonscomputer.com :3030 Follow-up (separate PR, after the UDM flip): strip the public Caddy vhosts from this box + optionally drop 80/443 from allowedTCPPorts. via hausgeist

boris added 1 commit 2026-09-28 00:41:36 +00:00

asusmini: allow LAN (192.168.1.0/24) access to pds/knot/spindle/automerge service ports be87dea4f5

Commons computer edge is moving to a Caddy LXC on pve (192.168.1.11);
the public 80/443 forwards follow shortly. The box firewall currently
only opens 22/80/443 on the wired interface, so the edge cannot reach
the 5555/5556/6555/3030 service ports. Allow them from the LAN only;
tailnet traffic already bypasses the firewall.

Follow-up PR: strip the public Caddy vhosts after the UDM flip.

aynish merged commit 4ab392bc45 into main

2026-09-28 01:31:06 +00:00

boris referenced this pull request

2026-09-28 02:04:39 +00:00

asusmini: open service ports via allowedTCPPorts (fix #1 — extraInputRules no-op on iptables backend) #2

boris referenced this issue from a commit

2026-09-28 02:04:40 +00:00

asusmini: open 5555/5556/6555/3030 via allowedTCPPorts (extraInputRules was nft-backend-only, no-op on iptables backend — PR #1 did not open the ports)

aynish referenced this issue from a commit

2026-09-28 04:20:18 +00:00

Merge pull request 'asusmini: open service ports via allowedTCPPorts (fix #1 — extraInputRules no-op on iptables backend)' (#2) from caddy-edge-iptables-backend into main

Sign in to join this conversation.