From efa6cf089921f7d267b91028b10debe4f935bb38 Mon Sep 17 00:00:00 2001 From: windyboy Date: Wed, 12 Aug 2026 08:36:51 +0800 Subject: [PATCH] docs(dns): record agh_ui_access LAN55 allow for Home Assistant (2026-08-12) --- hosts/dns.windy.lan.md | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/hosts/dns.windy.lan.md b/hosts/dns.windy.lan.md index 0b0e0ef..63bc9ad 100644 --- a/hosts/dns.windy.lan.md +++ b/hosts/dns.windy.lan.md @@ -32,10 +32,17 @@ Do not enable AdGuard Home DHCP unless the existing EdgeRouter DHCP service is explicitly migrated and disabled first. `agh-ui-access.service` loads `/etc/nftables-agh-ui-access.nft`. It permits -only `192.168.66.0/24` to TCP/80 and drops other TCP/80 input. It deliberately +`192.168.66.0/24` (LAN66) and `192.168.55.0/24` (LAN55, for Home Assistant +integration) to TCP/80 and drops other TCP/80 input. It deliberately does **not** restrict DNS, SSH, Docker, or Mihomo ports. Keep it isolated from Docker-managed nftables tables. +> 2026-08-12: added `192.168.55.0/24` allow so HAOS (`192.168.55.11`) can reach +the HTTP API on `:80` for the Home Assistant AdGuard Home integration; applied +via `sudo systemctl restart agh-ui-access.service` (file edited first, then +reloaded; syntax verified with `nft -c`). Other firewalls (EdgeRouter LAN_IN/ +LAN_OUT inactive, PVE zero rules) were already open for LAN55->LAN66. + Current query-log policy is 14 days with anonymized client IPs. Check free space before increasing retention. DNSSEC is disabled because the selected upstream path did not pass the known-bad-signature validation check; do not