# Omada Firewall Rules - Manual Check Required

**Date**: $(date)  
**Issue**: HTTP 502 from Blockscout via Cloudflare Tunnel  
**Root Cause**: "No route to host" error suggests firewall blocking

---

## 🔍 Current Status

### Diagnostic Results

**Connection Test:**
```bash
# From cloudflared container (VMID 102, IP: 192.168.11.7)
curl http://192.168.11.140:80/health
# Result: curl: (7) Failed to connect to 192.168.11.140 port 80
# Error: "No route to host"
```

**Analysis:**
- ✅ DNS configured correctly
- ✅ Tunnel route configured correctly  
- ❌ **Network connectivity: BLOCKED**
- ❌ **Firewall likely blocking traffic**

---

## 🔧 Manual Firewall Check Required

The Omada Controller API endpoint for firewall rules requires authentication that may not work via script. Please check manually:

### Step 1: Login to Omada Controller

**URL**: https://192.168.11.8:8043

**Credentials**: Use your Omada Controller admin username/password

### Step 2: Navigate to Firewall Rules

1. Click **Settings** (gear icon)
2. Navigate to **Firewall** → **Firewall Rules**

### Step 3: Check for Blocking Rules

Look for rules that might block Blockscout:

**Check these criteria:**
- **Destination IP**: 192.168.11.140
- **Destination Port**: 80
- **Protocol**: TCP
- **Action**: Deny or Reject
- **Direction**: Forward or In
- **Enabled**: Yes

### Step 4: Review Default Policies

Check if there are default deny policies that might block internal traffic.

---

## ✅ Required Firewall Rule

If no allow rule exists, create one:

### Rule Configuration

```
Name: Allow Internal to Blockscout HTTP
Enable: ✓ Yes
Action: Allow
Direction: Forward
Protocol: TCP
Source IP: 192.168.11.0/24 (or leave blank for "Any")
Source Port: (leave blank for "Any")
Destination IP: 192.168.11.140
Destination Port: 80
Priority: High (must be above any deny rules)
```

### Important: Rule Priority

- ✅ **Allow rules must have HIGHER priority** than deny rules
- ⚠️ Rules are processed in priority order (high → low)
- ✅ Place the allow rule **above** any deny rules in the list

---

## 📋 Checklist

- [ ] Login to Omada Controller (https://192.168.11.8:8043)
- [ ] Navigate to Settings → Firewall → Firewall Rules
- [ ] Check for deny rules blocking 192.168.11.140:80
- [ ] Check rule priority order
- [ ] Create allow rule if missing
- [ ] Ensure allow rule priority is HIGH (above deny rules)
- [ ] Apply/save configuration
- [ ] Test connectivity: `curl http://192.168.11.140:80/health`

---

## 🔍 What to Look For

### Blocking Patterns

1. **Destination IP Blocking:**
   - Any rule with `dstIp = 192.168.11.140`
   - Any rule with `dstIp = 192.168.11.0/24` and deny action

2. **Port Blocking:**
   - Any rule with `dstPort = 80` and deny action
   - Any rule with `dstPort = all` and deny action

3. **Default Deny Policies:**
   - Default deny rules at bottom of list
   - Catch-all deny rules

### Allow Patterns (Should Exist)

1. **Internal Access Allow:**
   - Source: 192.168.11.0/24
   - Destination: 192.168.11.140
   - Port: 80
   - Action: Allow
   - Priority: High

---

## 📝 Notes

- Both cloudflared (VMID 102) and Blockscout (VMID 5000) are on the same subnet (192.168.11.0/24)
- Traffic should be allowed by default for same-subnet communication
- If blocked, there's likely an explicit deny rule or restrictive default policy
- The "No route to host" error is typically a firewall/routing issue

---

**Last Updated**: $(date)  
**Status**: Manual check required - API endpoint needs authentication verification

