diff options
Diffstat (limited to 'docs/PACKAGING-GUIDE.md')
| -rw-r--r-- | docs/PACKAGING-GUIDE.md | 30 |
1 files changed, 30 insertions, 0 deletions
diff --git a/docs/PACKAGING-GUIDE.md b/docs/PACKAGING-GUIDE.md index 5a5c388..56504d4 100644 --- a/docs/PACKAGING-GUIDE.md +++ b/docs/PACKAGING-GUIDE.md @@ -202,6 +202,36 @@ sudo firewall-cmd --reload sudo ufw allow "MeshBay Cast" ``` +### Peer connections (node) + +Opens inbound UDP 1024-65535. **Scope it to the LAN** — apply the firewalld +service to the zone holding the LAN interface, and give the ufw rule a +`from`. It does not belong in an internet-facing zone. + +```bash +# Fedora (firewalld) — replace FedoraWorkstation with your LAN zone +sudo firewall-cmd --permanent --zone=FedoraWorkstation --add-service=meshbay-node +sudo firewall-cmd --reload + +# Ubuntu (ufw) +sudo ufw allow from 192.168.1.0/24 app "MeshBay Node" + +# a libvirt guest reaching the node on its own hypervisor: scope to the guest +# subnet, since traffic to the host's own address is not masqueraded +sudo ufw allow in on virbr0 from 192.168.200.0/24 app "MeshBay Node" +``` + +**Why a node needs this.** WebRTC binds an ephemeral UDP port per connection, +so there is no fixed port to open. A connection succeeds if *either* side can +initiate. Browsers publish their host candidate as an mDNS `<uuid>.local` +name, which `aioice` cannot resolve on any platform and discards — so the node +can never call a browser back, and the browser must call the node. A node that +refuses unsolicited inbound UDP is unreachable from every browser on its own +LAN, and falls back to reflexive candidates, which fail whenever both peers +share one public IP and the router will not hairpin. + +The node's administration surface is unaffected: loopback only, see below. + The node's own administration surface is a loopback API (127.0.0.1 only, per-run token) reached by the CLI and the desktop client's Node page. It is never network-exposed and ships no firewall profile. |