From b4e782455087a185965cc530ff8769693a87c752 Mon Sep 17 00:00:00 2001
From: gadget78 <crypto@gadet78.uk>
Date: Tue, 12 Aug 2025 04:47:42 +0100
Subject: [PATCH] added DNS check to the firewall (checking if its within the
 local LAN)

---
 dependencies/user-install.sh | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/dependencies/user-install.sh b/dependencies/user-install.sh
index 1c4d381..97b2261 100755
--- a/dependencies/user-install.sh
+++ b/dependencies/user-install.sh
@@ -1,7 +1,7 @@
 #!/bin/bash
 # Sashimono contract instance user installation script.
 # This is intended to be called by Sashimono agent.
-version=1.6
+version=1.9
 
 # Check for user cpu and memory quotas.
 cpu=$1
@@ -470,6 +470,17 @@ if [[ "$local_ip" != "$public_hostname_ip" ]]; then
     if [ -z "$lan_subnet" ]; then
         echo "Error: Could not detect LAN subnet."
     else
+        local_dns=$(grep '^nameserver' /etc/resolv.conf | awk 'NR==1 {print $2}')
+        if [ -z "$local_dns" ]; then
+            echo "Warning: Could not detect local DNS IP."
+        else
+            if [ "$(echo "$local_dns" | cut -d'.' -f1-2)" = "$(echo "$lan_subnet" | cut -d'.' -f1-2)" ]; then
+                echo "detected local DNS IP as $local_dns, allowing. (as within the lan subnet of $lan_subnet)"
+                nft add rule ip docker_filter_$user_id OUTPUT meta skuid $user_id ip daddr $local_dns accept
+            else
+                echo "detected local DNS IP as $local_dns, not part of lan subnet of $lan_subnet"
+            fi
+        fi
         echo "detected lan subnet ip to $lan_subnet, blocking/dropping"
         nft add rule ip docker_filter_$user_id OUTPUT meta skuid $user_id ip daddr $lan_subnet drop
     fi