# Omada Firewall Analysis - Blockscout Tunnel Route Blocking

**Date**: $(date)  
**Issue**: HTTP 502 from Blockscout via Cloudflare Tunnel  
**Root Cause**: "No route to host" error when cloudflared tries to reach Blockscout

---

## 🔍 Diagnostic Results

### Connection Test Results

**From cloudflared container (VMID 102) to Blockscout:**
```bash
curl http://192.168.11.140:80/health
# Result: curl: (7) Failed to connect to 192.168.11.140 port 80 after 3098 ms: Could not connect to server
# Error: "No route to host"
```

**Analysis:**
- ✅ DNS configuration: Working (DNS configured correctly)
- ✅ Tunnel route: Working (tunnel route configured correctly)  
- ❌ **Network connectivity: BLOCKED** ("No route to host" error)
- ❌ **Firewall**: Likely blocking traffic from cloudflared to Blockscout

---

## 📊 Network Topology

### Current Configuration

| Component | IP Address | Network | Status |
|-----------|------------|---------|--------|
| Blockscout Container (VMID 5000) | 192.168.11.140 | 192.168.11.0/24 | ✅ Running |
| cloudflared Container (VMID 102) | 192.168.11.x | 192.168.11.0/24 | ✅ Running |
| Omada Controller | 192.168.11.8:8043 | 192.168.11.0/24 | ✅ Running |
| ER605 Router | 192.168.11.1 | 192.168.11.0/24 | ✅ Running |

**Note**: Both containers are on the same subnet (192.168.11.0/24), so traffic should be allowed by default unless firewall rules explicitly block it.

---

## 🔐 Firewall Rules Analysis

### Default Omada Policy (From Documentation)

```
WAN → LAN: Deny (default)
LAN → WAN: Allow (with NAT)
Inter-VLAN: Allow (for routing)
```

**Expected Behavior:**
- LAN → LAN traffic (same subnet): Should be allowed
- However, if custom firewall rules exist, they may override default behavior

### Potential Blocking Rules

Based on the "No route to host" error, check for:

1. **Port 80 Blocking Rules**
   ```
   Rule Type: Deny
   Destination Port: 80
   Protocol: TCP
   Direction: Forward or In
   ```

2. **Destination IP Restrictions**
   ```
   Rule Type: Deny
   Destination IP: 192.168.11.140
   ```

3. **Source-Based Restrictions**
   ```
   Rule Type: Deny
   Source IP: 192.168.11.x (cloudflared container IP)
   Destination IP: 192.168.11.140
   ```

4. **Default Deny Policies**
   ```
   Rule Type: Deny (default/catch-all)
   Applied to: All internal traffic
   ```

---

## ✅ Required Firewall Rules

### Rule 1: Allow Internal Access to Blockscout HTTP

```
Name: Allow Internal to Blockscout HTTP
Enable: ✓
Action: Allow
Direction: Forward
Protocol: TCP
Source IP: 192.168.11.0/24
Destination IP: 192.168.11.140
Destination Port: 80
Priority: High (must be above any deny rules)
```

### Rule 2: Allow Cloudflare Tunnel to Blockscout

```
Name: Allow Cloudflare Tunnel to Blockscout
Enable: ✓
Action: Allow
Direction: Forward
Protocol: TCP
Source IP: Any (or specific cloudflared IP range)
Destination IP: 192.168.11.140
Destination Port: 80
Priority: High
```

---

## 🔧 Resolution Steps

### Step 1: Check Current Firewall Rules

**In Omada Controller Web Interface:**

1. **Login**: https://192.168.11.8:8043
2. **Navigate to**: Settings → Firewall → Firewall Rules
3. **Review all rules** for:
   - Destination IP = 192.168.11.140
   - Destination Port = 80
   - Action = Deny or Block
   - Direction = Forward or In

### Step 2: Create Allow Rule

**Create a new firewall rule:**

1. **Name**: `Allow Internal to Blockscout HTTP`
2. **Enable**: ✓
3. **Action**: Allow
4. **Direction**: Forward
5. **Protocol**: TCP
6. **Source IP**: `192.168.11.0/24` (or leave blank for "Any")
7. **Destination IP**: `192.168.11.140`
8. **Destination Port**: `80`
9. **Priority**: **High** (ensure it's placed above any deny rules)
10. **Save and Apply**

### Step 3: Verify Rule Order

**Important**: Firewall rules are processed in priority order. Ensure:
- Allow rules for Blockscout are **above** any deny rules
- Default deny policies are at the **bottom** of the list

### Step 4: Test Connectivity

```bash
# From cloudflared container
ssh root@192.168.11.12
pct exec 102 -- curl -v http://192.168.11.140:80/health

# Expected: HTTP 200 or JSON response
# If still fails: Check router logs and rule priority
```

---

## 📋 Verification Checklist

- [ ] Login to Omada Controller (192.168.11.8:8043)
- [ ] Navigate to Firewall Rules
- [ ] Check for deny rules blocking 192.168.11.140:80
- [ ] Check rule priority order (allow rules above deny rules)
- [ ] Create allow rule if missing
- [ ] Apply configuration
- [ ] Test connectivity from cloudflared container
- [ ] Verify Blockscout is accessible via tunnel

---

## 🔍 Additional Troubleshooting

### If Still Not Working After Adding Rule:

1. **Check Router Logs:**
   - Navigate to: Statistics → Logs → Firewall Logs
   - Filter for: Destination IP = 192.168.11.140
   - Look for: Deny/Block actions

2. **Verify Rule Priority:**
   - Ensure allow rules have higher priority than deny rules
   - Check if default deny policy is overriding allow rules

3. **Test from Different Source:**
   ```bash
   # Test from Proxmox host
   curl http://192.168.11.140:80/health
   
   # Test from another container
   pct exec <another-vmid> -- curl http://192.168.11.140:80/health
   ```

4. **Check Blockscout Container Network:**
   ```bash
   pct exec 5000 -- ip route show
   pct exec 5000 -- ip addr show
   ```

---

## 📝 Summary

**Root Cause**: Omada firewall rules are blocking traffic from cloudflared container (VMID 102) to Blockscout (192.168.11.140:80).

**Solution**: Create an explicit allow rule in Omada Controller firewall to permit internal traffic to Blockscout on port 80.

**Priority**: High - This is blocking the Cloudflare tunnel route to Blockscout.

---

**Last Updated**: $(date)  
**Status**: Action Required - Add firewall allow rule in Omada Controller

