[S-6] Dead WAN→2121 ACCEPT firewall rule contradicts nft drop (latent exposure)
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 55/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Active
- Tech stack
- shell
- Domain
- infrastructure, security
Research direction
Start by confirming the finding still exists upstream: read the ACCEPT rule in the 99-tollgate-setup uci-defaults script around lines 174-181, then check it against the nftables drop for port 2121 in 30-backend-firewall.nft. If the rule is still present and contradicts the drop, remove it from the uci-defaults script. Done means the WAN-to-2121 traffic remains blocked by the nft rules and no ACCEPT rule for that port is left in the uci config.
Written by the indexing model from the issue text.
Description
Migrated from Amperstrand/tollgate-module-basic-go#77 as part of the fork retirement — OpenTollGate/tollgate-module-basic-go is the single source of truth; the fork issue carries the original discussion and any lab evidence. Retirement plan: #758.]
MEDIUM: A stale ACCEPT rule in uci-defaults (99-tollgate-setup:174-181) allows WAN→:2121 traffic, contradicting the actual nftables drop in 30-backend-firewall.nft. This creates latent exposure if firewall rules are reloaded in a different order or if the nft drop is accidentally removed.
The dead rule serves no purpose and may create a false sense of security while actually creating an exposure vector.
Fix: Delete the dead rule from uci-defaults.
Evidence: /home/ubuntu/src/tollgate_audit_report_2026-08-26.md §7, line 149
File references: uci-defaults 99-tollgate-setup:174-181 vs 30-backend-firewall.nft
Migrated 2026-10-09. Applicability to current upstream main (4614ac2, post-rc1) was not re-verified during migration — confirming whether the finding still reproduces upstream is this issue's first task.
- Dominant language
- Go
- Stars
- 12
- Forks
- 14
- Avg merge
- 1d 4h
- Merged PRs (30d)
- 244
Getting set up
- No Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from OpenTollGate/tollgate-module-basic-go
-
Session event emits the customer's MAC address in the p tag — spec-invalid value on every payment responsePossibly taken @Amperstrand claimed this 4 days ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
OpenTollGate/tollgate-module-basic-go#949 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
OpenTollGate/tollgate-module-basic-go#833 · 1 comment ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
OpenTollGate/tollgate-module-basic-go#813 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
OpenTollGate/tollgate-module-basic-go#804 ·
Maintainers usually reply within 1 day
-
go-battery needs an ndsctl on PATH: TestPurchaseSessionGuardHoldsThroughTheOutcomeUnknownWindow fails on bare hosts (passes with stub)Possibly taken @Amperstrand claimed this 8 days ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
OpenTollGate/tollgate-module-basic-go#726 · 2 comments ·
Maintainers usually reply within 1 day
All issues in OpenTollGate/tollgate-module-basic-go
Similar issues
-
Go device SDK: Whisper transcriber keeps buffering and transcribing audio appended after Stop()Possibly taken @apoorvdarshan claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
BasedHardware/omi#22770 ·
Maintainers usually reply within 1 day
-
Bug v3
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Maintainers usually reply within 1 day
-
bug needs-acceptance wg/router-models-inference-runtime
Difficulty 2/5 1-3 hours Newbie friendliness 66/100
vllm-project/semantic-router#5295 ·
Maintainers usually reply within 1 day
-
plan lint: overclaim fires on every page linted without enrichment (regex matches inlined chrome.js)Open
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 64/100
openilink/openilink-hub#271 ·