I would really appreciate it if someone would double check me. Sorry for the screenshot. Either the Lemmy code button isn't great or I'm just dum at formatting.

This has local *arr servers available and traceroute shows me going through the VPN.

The largest blue blotch is the ip address of a mullvad vpn server.

Rpi4, Raspberry Pi OS lite.

Mullvad VPN. IPv6 has been nuked. Using Wireguard through wg-quick.

wg2 originates from a .conf file from Mullvad with IPv6 stripped.

Do these UFW settings look right?

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 3 points 2 years ago (2 children)

I've got 53 and 5353 open so that DNS will work for my local network when connecting to *arr and jellyfin.

I.E. type raspberrypi:8989 in a browser to bring up Sonarr.

Should I restrict to UDP?

[–] [email protected] 6 points 2 years ago

Just did some reading as it has been many years since I did firewall.. looks like dns is mostly UDP, but fails over to TCP if the dns reply exceeds 512bytes.

[–] dragonfly4933 5 points 2 years ago

No, you should keep both udp and tcp port 53 open going out. blocking dns vc/tcp will result in dns being partially broken.