Release v1.11.2: Protect camera VLAN detection, Cloudflare port forward checks, DNS and notes fixes#393
Merged
tvancott42 merged 4 commits intomainfrom Mar 1, 2026
Merged
Release v1.11.2: Protect camera VLAN detection, Cloudflare port forward checks, DNS and notes fixes#393tvancott42 merged 4 commits intomainfrom
tvancott42 merged 4 commits intomainfrom
Conversation
* Detect Protect cameras on wrong VLAN via Protect API Protect cameras (G6 Pro Bullet, etc.) don't appear in stat/sta so CameraVlanRule never saw them. Now checks port MACs against the Protect camera collection before the ForwardMode gate, and a fallback pass in ConfigAuditEngine catches cameras not matched to any port. Uses ConnectionNetworkId from the Protect API for 100% confidence detection. * Add TODO notes for 802.1X VLAN placement gap and Protect infrastructure devices
…375) (#388) * Cloudflare IP restriction check for actively targeted port forwards (#375) Downgrades severity when a targeted port forward has source IP restrictions: - Cloudflare-only restriction: Info (0 points) - properly locked down - Other IP restriction: Recommended (3 points) - some protection in place - No restriction: Critical/Recommended (7/3 points) - fully exposed Adds CloudflareIpRanges utility in Core/Helpers with hardcoded IPv4/IPv6 ranges. * Add context-specific recommendation messages for threat exposure issues Each restriction level gets its own recommendation: - Cloudflare-only: no action needed - Other restriction: suggests switching to Cloudflare IP Network List - No restriction: explains how to create a Network List and apply it * Link threat exposure issues to Threat Intelligence port drilldown Issue descriptions now include "See Threat Intelligence for details" with a deep link to /threats?tab=drilldown&port=X for the specific port.
The notes fields (Speed Test details, UPnP Inspector) only triggered auto-save via @onkeyup, which doesn't fire on paste. Moved debounce into @oninput (fires on any text change) and added @onfocusout to save immediately on blur. Both paths funnel through a common debounced save with skip-if-unchanged guard.
…#392) * Fix device DNS check to accept any gateway IP or admin-configured DNS (#389) The device DNS misconfigured check was comparing against a single expected gateway IP (from the management network). This caused false positives when devices pointed to a different VLAN's gateway or to an admin-configured DNS server like Pi-hole. Now accepts any gateway IP from any network (same physical gateway, different interfaces) and any DHCP DNS servers configured by the admin. * Fix device DNS check to accept management gateway, native gateway, or admin-configured DNS (#389) The device DNS misconfigured check was comparing against a single expected gateway IP (from the management network). This caused false positives when devices pointed to a different valid target. Valid DNS targets for infrastructure devices are now: 1. Management network gateway (LAN-local gateway) 2. Native/VLAN 1 gateway (main gateway IP) 3. Admin-configured DHCP DNS servers (Pi-hole, AdGuard Home, etc.) * Use per-device subnet gateway instead of single global gateway Valid DNS for each infrastructure device is now: 1. The device's own subnet gateway (matched by IP) 2. The native/VLAN 1 gateway 3. Admin-configured DHCP DNS servers (Pi-hole, AdGuard, etc.)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
PRs included
Test plan