hernani/koopa-admin-log
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

docs: verify firewalld 9200 for Forgejo git-SSH

Browse source
This commit is contained in:
Hernâni Marques 2026-07-10 14:45:56 +02:00
parent 0c7d96b584
commit e194c16774
No known key found for this signature in database
3 changed files with 52 additions and 41 deletions
Download patch file Download diff file Expand all files Collapse all files

89
configs/firewalld/public-ports.md
View file

@ -1,50 +1,61 @@
# firewalld zone public (eno1)
## Current (2026-07-10)
## Current (2026-07-10, verified)
Expected open ports after Forgejo git-SSH:
```
firewall-cmd --list-ports
# 80/tcp 443/tcp 8080/tcp 9000/tcp 9001/tcp 23235/tcp 9200/tcp
```
| Port | Purpose |
|------|---------|
| 80/tcp | `http-proxy.socket` → Caddy 9000 (needed for **IPv6** WAN HTTP/ACME) |
| **443/tcp** | `https-proxy.socket` → Caddy 9001 (**required for IPv6** AAAA `:15d6`) |
| 9000/tcp | Caddy HTTP (VeciGate IPv4 WAN:80 → 9000) |
| 9001/tcp | Caddy HTTPS (VeciGate IPv4 WAN:443 → 9001) |
| 8080/tcp | Tor OR |
| 23235/tcp | SSH (VeciGate maps public 23235 → host 22) |
| **9200/tcp** | **Forgejo git-SSH** (VeciGate WAN/hairpin/IPv6 → host 9200 → container 2222) |
| dhcpv6-client, ssh | services |
### Add / verify 9200
```bash
sudo firewall-cmd --permanent --add-port=9200/tcp
sudo firewall-cmd --reload
sudo firewall-cmd --list-ports
ss -lntp | grep 9200
# … 80/tcp 443/tcp 8080/tcp 9000/tcp 9001/tcp 23235/tcp 9200/tcp
```
### Why 443 is required again
| Port | Purpose | LAN probe (2026-07-10) |
|------|---------|------------------------|
| 80/tcp | `http-proxy` → Caddy 9000 (IPv6 HTTP/ACME) | via Caddy path |
| **443/tcp** | `https-proxy` → Caddy 9001 (IPv6 HTTPS) | via Caddy path |
| 9000/tcp | Caddy HTTP (WAN:80 → 9000) | **OK** |
| 9001/tcp | Caddy HTTPS (WAN:443 → 9001) | **OK** |
| 8080/tcp | Tor OR | — |
| 23235/tcp | (legacy list; host SSH is :22, WAN via VeciGate 23235→22) | — |
| **9200/tcp** | **Forgejo git-SSH** (podman rootlessport) | **OK** after add+reload |
IPv4 public HTTPS is DNAT’d to **9001**, so opening only 9001 was enough.
IPv6 has **no DNAT**: clients hit `2a02:168:53a8:0:d584:9e34:13cf:15d6:443`
directly. Without 443/tcp in firewalld, AAAA looked like `ERR_ADDRESS_UNREACHABLE`
/ connect timeout while IPv4 still worked.
### Why 9200
Forgejo advertises `SSH_PORT=9200`. Rootless podman publishes `0.0.0.0:9200→2222`.
VeciGate DNATs WAN:9200 and hairpins public A:9200; IPv6 forwards :9200 to koopa.
Without firewalld **9200/tcp**, external/LAN clients see **connection refused** even
though `ss` shows LISTEN on the host (local-only path still works).
## History
### Not opened on purpose
| Port | Note |
|------|------|
| 443 removed earlier | “old host HTTPS before DNAT to 9001” — re-added 2026-07-09 for IPv6 |
| 8082/tcp removed | old Podman ACME |
| **9200/tcp added** | 2026-07-10 Forgejo git-SSH |
| 9020–9024 | rootless apps; public HTTP only via Caddy → `127.0.0.1:90xx` |
| 9024 | Forgejo HTTP internal to Caddy only |
LAN `nc` to 9021/9024 → **connection refused** is expected without firewalld open (and not required).
### Commands
```bash
sudo firewall-cmd --permanent --add-port=9200/tcp
sudo firewall-cmd --reload # or systemctl restart firewalld
sudo firewall-cmd --list-ports
```
### Verify (from another host on LAN / WAN)
```bash
nc -vz 192.168.100.95 9200
nc -vz 212.51.151.254 9200 # hairpin / public A
ssh -p 9200 -T git@git.hacktivism.ch
# expect: Hi there, … authenticated … Forgejo does not provide shell access.
```
### Why 443
IPv4 HTTPS is DNAT’d to **9001**. IPv6 has **no DNAT** — clients hit host **:443** directly.
### Why 9200
Forgejo advertises `SSH_PORT=9200`. Traffic hits **host:9200** (not Caddy). Without firewalld **9200/tcp**, clients get **connection refused** even while `ss` shows LISTEN and localhost works.
## History
| When | Change |
|------|--------|
| 2026-07-09 | 443/tcp re-added for IPv6 |
| 2026-07-10 | **9200/tcp** for Forgejo git-SSH (verified LAN + hairpin + SSH auth) |