# Omada Firewall Rules Review - Blockscout Tunnel Access

**Date**: $(date)  
**Issue**: HTTP 502 from Blockscout via Cloudflare Tunnel  
**Blockscout**: 192.168.11.140:80  
**Tunnel**: VMID 102 (cloudflared on 192.168.11.x)

---

## Overview

The Cloudflare tunnel route to Blockscout is configured correctly, but HTTP 502 errors suggest network connectivity issues. This document reviews Omada firewall rules that might be blocking access.

---

## Current Configuration

### Blockscout Network
- **IP**: 192.168.11.140
- **Port**: 80 (Nginx reverse proxy)
- **VLAN**: 11 (MGMT-LAN)
- **Container**: VMID 5000 on pve2 node

### Cloudflare Tunnel
- **Container**: VMID 102 (cloudflared)
- **Network**: 192.168.11.0/24 (VLAN 11)
- **Tunnel Route**: explorer.d-bis.org → http://192.168.11.140:80

---

## Firewall Rules Analysis

### Default Policy (From ER605 Router Config)

```
WAN → LAN: Deny (default)
LAN → WAN: Allow (with NAT)
Inter-VLAN: Allow (for routing)
```

**⚠️ Important**: The default "WAN → LAN: Deny" policy may affect tunnel traffic depending on how Omada classifies the traffic.

### Cloudflare Tunnel Traffic Flow

```
Internet → Cloudflare Edge → Cloudflare Tunnel (VMID 102) → Blockscout (192.168.11.140:80)
```

Since cloudflared (VMID 102) initiates the connection to Blockscout, this is **LAN → LAN** traffic (both on 192.168.11.0/24), which should be allowed by default.

---

## Potential Blocking Issues

### 1. Port 80 Blocking Rules

**Check for rules that block port 80:**
```
Rule Type: Deny
Destination Port: 80
Protocol: TCP
```

**Solution**: Ensure no deny rules block port 80 for internal traffic.

### 2. Destination IP Restrictions

**Check for rules blocking 192.168.11.140:**
```
Rule Type: Deny
Destination IP: 192.168.11.140
```

**Solution**: Verify Blockscout IP is not blocked.

### 3. Inter-VLAN Routing Issues

If cloudflared and Blockscout are on different VLANs, check inter-VLAN routing rules.

**Current Status**: Both appear to be on VLAN 11 (192.168.11.0/24), so this should not be an issue.

### 4. Default Deny Policy Override

If a default deny policy is too restrictive, it may block legitimate internal traffic.

---

## Required Firewall Rules

### Rule 1: Allow Cloudflare Tunnel to Blockscout

```
Name: Allow Cloudflare Tunnel to Blockscout
Enable: ✓
Action: Allow
Direction: Forward
Protocol: TCP
Source IP: 192.168.11.0/24 (or specific cloudflared IP)
Destination IP: 192.168.11.140
Destination Port: 80
Priority: High (above deny rules)
```

### Rule 2: Allow Internal Access to Blockscout

```
Name: Allow Internal to Blockscout HTTP
Enable: ✓
Action: Allow
Direction: Forward
Protocol: TCP
Source IP: 192.168.11.0/24
Destination IP: 192.168.11.140
Destination Port: 80, 4000
Priority: High
```

---

## Verification Steps

### 1. Check Current Firewall Rules

**In Omada Controller:**
1. Login: https://192.168.11.8:8043 (or your Omada controller URL)
2. Navigate to: **Settings** → **Firewall** → **Firewall Rules**
3. Review all rules for:
   - Destination IP: 192.168.11.140
   - Destination Port: 80
   - Action: Deny or Block

### 2. Test Connectivity

```bash
# From cloudflared container (VMID 102)
ssh root@192.168.11.12  # or appropriate node
pct exec 102 -- curl -v http://192.168.11.140:80/health

# From any container on same network
curl -v http://192.168.11.140:80/health
```

### 3. Check Router Logs

**In Omada Controller:**
1. Navigate to: **Statistics** → **Logs** → **Firewall Logs**
2. Filter for:
   - Destination IP: 192.168.11.140
   - Port: 80
   - Action: Deny or Block

---

## Troubleshooting

### Issue: HTTP 502 Bad Gateway

**Possible Causes:**
1. ✅ DNS configured correctly
2. ✅ Tunnel route configured correctly
3. ⚠️ Firewall blocking internal traffic
4. ⚠️ Blockscout not fully started

### Diagnostic Steps

1. **Test Internal Connectivity:**
   ```bash
   # From cloudflared container
   pct exec 102 -- curl http://192.168.11.140:80/health
   
   # Expected: JSON response or HTTP 200
   # If fails: Firewall or network issue
   ```

2. **Check Blockscout Status:**
   ```bash
   pct exec 5000 -- docker ps | grep blockscout
   pct exec 5000 -- curl http://127.0.0.1:4000/api/v2/status
   ```

3. **Check Nginx Status:**
   ```bash
   pct exec 5000 -- systemctl status nginx
   pct exec 5000 -- curl http://127.0.0.1:80/health
   ```

---

## Recommended Configuration

### If Using Omada Controller API

Create/update firewall rules via API or manually:

```json
{
  "name": "Allow Cloudflare Tunnel to Blockscout",
  "enable": true,
  "action": "allow",
  "protocol": "tcp",
  "dstIp": "192.168.11.140",
  "dstPort": "80",
  "direction": "forward",
  "priority": 100
}
```

### Manual Configuration Steps

1. **Login to Omada Controller**
2. **Navigate to**: Settings → Firewall → Firewall Rules
3. **Create New Rule**:
   - Name: Allow Cloudflare Tunnel to Blockscout
   - Action: Allow
   - Direction: Forward
   - Protocol: TCP
   - Destination IP: 192.168.11.140
   - Destination Port: 80
   - Priority: High (ensure it's above any deny rules)
4. **Save and Apply**

---

## Summary

**Key Points:**
- Both cloudflared and Blockscout are on VLAN 11 (192.168.11.0/24)
- Default inter-VLAN routing should allow this traffic
- Check for specific deny rules blocking port 80 or destination IP
- Ensure allow rules have higher priority than deny rules

**Next Steps:**
1. Review current Omada firewall rules
2. Test internal connectivity (cloudflared → Blockscout)
3. Add explicit allow rule if needed
4. Verify Blockscout and Nginx are running

---

**Last Updated**: $(date)  
**Status**: Review required - check Omada firewall rules for blocks

