blob: 2f863ec52c5c8d01ba8bbf12192e22aca8467077 (
plain) (
blame)
1
2
3
4
5
6
|
<?xml version="1.0" encoding="utf-8"?>
<service>
<short>MeshBay Node</short>
<description>Inbound WebRTC/ICE for a MeshBay node. Peers connect over a DataChannel negotiated through the hub; there is no fixed listening port, because aiortc binds an ephemeral UDP port per connection. A peer that cannot reach the node directly can only be reached if the node initiates, which requires the peer to publish a routable address — browsers do not, they publish an mDNS .local name the node cannot resolve. So a node that refuses unsolicited inbound UDP is unreachable from any browser it cannot itself call back. Apply this to the zone holding the LAN interface only; it does not belong in an internet-facing zone. The node's administration surface is unaffected: it is a loopback API on 127.0.0.1 and is never exposed here.</description>
<port protocol="udp" port="1024-65535"/>
</service>
|