# Omada Cloud Controller Access - Summary

**Date**: $(date)  
**Purpose**: Access Omada Cloud Controller to check/configure firewall rules for Blockscout

---

## 🔐 Access Information

### Cloud Controller URL
```
https://omada.tplinkcloud.com
```

### Credentials (from .env file)
- **Username**: `tp-link_admin` (from `OMADA_ADMIN_USERNAME`)
- **Password**: Check `.env` file for `OMADA_ADMIN_PASSWORD`

**Note**: Omada Cloud Controller typically uses **TP-Link ID** credentials. If the admin credentials don't work, you may need to use your TP-Link account credentials instead.

---

## 📋 Quick Access Steps

1. **Navigate to Cloud Controller:**
   - URL: https://omada.tplinkcloud.com
   - Or run: `bash scripts/access-omada-cloud-controller.sh`

2. **Login:**
   - Use credentials from .env file (or TP-Link ID if different)

3. **Access Your Controller:**
   - Click **"Launch"** on your Omada Controller in the list

4. **Navigate to Firewall Rules:**
   - Click **Settings** (gear icon)
   - Click **Firewall** in left sidebar
   - Click **Firewall Rules** tab

---

## 🔍 Blockscout Firewall Rule Check

### What to Look For

**Blocking Rules:**
- Destination IP: `192.168.11.140`
- Destination Port: `80`
- Action: **Deny** or **Reject**

**Required Allow Rule:**
- Source IP: `192.168.11.0/24`
- Destination IP: `192.168.11.140`
- Destination Port: `80`
- Protocol: `TCP`
- Action: **Allow**
- Priority: **High** (above deny rules)

---

## ✅ Creating Firewall Rule

If no allow rule exists, create one with these settings:

```
Name: Allow Internal to Blockscout HTTP
Enable: ✓ Yes
Action: Allow
Direction: Forward
Protocol: TCP
Source IP: 192.168.11.0/24
Source Port: (leave blank for Any)
Destination IP: 192.168.11.140
Destination Port: 80
Priority: High
```

**Important**: Ensure the allow rule has **HIGHER priority** than any deny rules (place it above deny rules in the list).

---

## 🧪 Verification

After creating the rule, test connectivity:

```bash
# From Proxmox host
pct exec 102 -- curl http://192.168.11.140:80/health

# Should return HTTP 200 (not "No route to host")
```

Then test via Cloudflare Tunnel:

```bash
curl https://explorer.d-bis.org/health
# Should return HTTP 200 (not 502 Bad Gateway)
```

---

## 📝 Notes

- Both containers are on the same subnet (192.168.11.0/24)
- Traffic should be allowed by default for same-subnet communication
- If blocked, there's likely an explicit deny rule or restrictive default policy
- The "No route to host" error indicates a firewall/routing issue

---

**Last Updated**: $(date)  
**Status**: Ready for manual configuration via cloud controller web interface

