Skip to content

feat: add nethsupport UI on port 8443 with automatic firewall rules #1565

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
stephdl wants to merge 9 commits into from
Closed

feat: add nethsupport UI on port 8443 with automatic firewall rules #1565

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
b573148
feat: add nethsupport UI on port 8443 with automatic firewall rules
stephdl Mar 9, 2026
417318a
refactor: remove reload_service from ns-ui init script
stephdl Mar 9, 2026
28be044
fix: add port 8443 to don nftables input rule
stephdl Mar 9, 2026
34f946d
fix: update firewall rules to allow input on port 8443 from VPN network
stephdl Mar 9, 2026
eda4027
fix: restrict firewall zone input to REJECT by default, only allow 84…
stephdl Mar 9, 2026
0c1cdae
fix: block access to port 8443 from LAN and WAN, allowing only VPN ac…
stephdl Mar 9, 2026
99300f8
fix: remove redundant WAN block for port 8443, only block from LAN
stephdl Mar 9, 2026
a2c2e53
refactor: remove forward rule, restrict access to port 8443 only
stephdl Mar 9, 2026
7fb5f2e
fix: suppress firewall reload output in cleanup and configuration fun…
stephdl Mar 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion packages/ns-don/files/20-don.nft
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1 @@
iifname "tunDON" tcp dport {981,9090,443,19999} counter accept comment ns-allow-don
iifname "tunDON" tcp dport {981,9090,443,8443,19999} counter accept comment ns-allow-don
54 changes: 54 additions & 0 deletions packages/ns-don/files/don
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,6 +37,18 @@ function cleanup
uci -q delete rpcd.ns_don
# commit rpcd changes
uci commit rpcd
# disable nethsupport UI on port 8443
uci set ns-ui.config.nsui_nethsupport_enable='0'
uci commit ns-ui
/usr/sbin/ns-ui
# Remove network and firewall configuration
uci -q delete network.don
uci commit network
uci -q delete firewall.ns_don_zone
uci -q delete firewall.ns_don_8443
uci -q delete firewall.block_8443_lan
uci commit firewall
/etc/init.d/firewall reload &> /dev/null
# destroy ubus sessions
session=$(ubus call session list | jq -r '.ubus_rpc_session as $parent | .data.username | select(. == "nethsupport") | $parent')
if [ "$session" != "" ]; then
Expand Down Expand Up @@ -175,6 +187,48 @@ EOF
# commit rpcd changes
uci commit rpcd

# Enable nethsupport UI on port 8443
uci set ns-ui.config.nsui_nethsupport_enable='1'
uci commit ns-ui
/usr/sbin/ns-ui

# Configure network and firewall for remote access
# Declare tunDON as a network interface
uci set network.don=interface
uci set network.don.proto='none'
uci set network.don.ifname='tunDON'
uci commit network

# Create zone for don network interface
uci set firewall.ns_don_zone=zone
uci set firewall.ns_don_zone.name='don'
uci set firewall.ns_don_zone.input='REJECT'
uci set firewall.ns_don_zone.output='ACCEPT'
uci set firewall.ns_don_zone.forward='ACCEPT'
uci del_list firewall.ns_don_zone.network 2>/dev/null || true
uci add_list firewall.ns_don_zone.network='don'

# Create input rule to allow port 8443 from VPN network 172.29.0.0/16
uci set firewall.ns_don_8443=rule
uci set firewall.ns_don_8443.name='Allow-Nethsupport-Port-8443'
uci set firewall.ns_don_8443.src='don'
uci set firewall.ns_don_8443.proto='tcp'
uci set firewall.ns_don_8443.src_ip='172.29.0.0/16'
uci set firewall.ns_don_8443.dest_port='8443'
uci set firewall.ns_don_8443.target='ACCEPT'

# Block port 8443 from LAN (only accessible from VPN)
# Note: WAN already rejects all input by default, so no need to block 8443 there
uci set firewall.block_8443_lan=rule
uci set firewall.block_8443_lan.name='Block-Port-8443-from-LAN'
uci set firewall.block_8443_lan.src='lan'
uci set firewall.block_8443_lan.proto='tcp'
uci set firewall.block_8443_lan.dest_port='8443'
uci set firewall.block_8443_lan.target='REJECT'

uci commit firewall
/etc/init.d/firewall reload &> /dev/null

show_credentials
;;
stop)
Expand Down
2 changes: 2 additions & 0 deletions packages/ns-ui/files/config
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,4 +4,6 @@ config main 'config'
option nsui_enable '1'
option nsui_extra_port '9090'
option nsui_extra_enable '1'
option nsui_nethsupport_port '8443'
option nsui_nethsupport_enable '0'
option server_tokens 'on'
37 changes: 27 additions & 10 deletions packages/ns-ui/files/ns-ui
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,17 +27,21 @@ else
[ -f "$LUCI_FILE" ] && mv -f "$LUCI_FILE" "$LUCI_FILE.disabled"
fi

# Manage extra ns-ui instance on custom port
nsui_extra_enable=$(uci -q get ns-ui.config.nsui_extra_enable)
nsui_extra_port=$(uci -q get ns-ui.config.nsui_extra_port)
crt=$(uci -q get nginx._lan.ssl_certificate)
key=$(uci -q get nginx._lan.ssl_certificate_key)
server_tokens=$(uci -q get ns-ui.config.server_tokens)
if [[ "$nsui_extra_enable" == "1" && "$nsui_extra_port" != "" ]]; then
cat <<EOF > "$NSUI_EXTRA_FILE"

# Function to generate extra ns-ui instances on custom ports
generate_extra_instance() {
local enable=$1
local port=$2
local config_file=$3

if [[ "$enable" == "1" && "$port" != "" ]]; then
cat <<EOF > "$config_file"
server {
listen $nsui_extra_port ssl default_server;
listen [::]:$nsui_extra_port ssl default_server;
listen $port ssl default_server;
listen [::]:$port ssl default_server;
server_name _lan;
ssl_certificate $crt;
ssl_certificate_key $key;
Expand All @@ -62,9 +66,22 @@ server {
}
}
EOF
else
rm -f "$NSUI_EXTRA_FILE" || :
fi
else
rm -f "$config_file" || :
fi
}

# Manage extra ns-ui instance on custom port (default 9090)
nsui_extra_enable=$(uci -q get ns-ui.config.nsui_extra_enable)
nsui_extra_port=$(uci -q get ns-ui.config.nsui_extra_port)
NSUI_EXTRA_FILE=/etc/nginx/conf.d/ns-ui.conf
generate_extra_instance "$nsui_extra_enable" "$nsui_extra_port" "$NSUI_EXTRA_FILE"

# Manage nethsupport instance on port 8443
nsui_nethsupport_enable=$(uci -q get ns-ui.config.nsui_nethsupport_enable)
nsui_nethsupport_port=$(uci -q get ns-ui.config.nsui_nethsupport_port)
NSUI_NETHSUPPORT_FILE=/etc/nginx/conf.d/ns-ui-nethsupport.conf
generate_extra_instance "$nsui_nethsupport_enable" "$nsui_nethsupport_port" "$NSUI_NETHSUPPORT_FILE"

if /usr/sbin/nginx -c /etc/nginx/uci.conf -T &> /dev/null ; then
/etc/init.d/nginx restart
Expand Down
Loading