A security fix for local mode, saved DNS servers and a choice of primary DNS server in House Arrest, a Threat Watch warning when the toolkit can't reach your console, and several fixes. This release also includes the changes listed for 1.13.5, which wasn't released separately. Updating is recommended for everyone running in local mode.
Security
- Local mode now checks that requests come from the toolkit's own pages (#145). With login switched off, the check that stops other websites from sending requests to the toolkit was skipped along with the login. A web page opened by anyone on your network could send a request to the toolkit's LAN address and block or unblock a Wi-Fi Stalker device, release a DNS Lockdown, or change Threat Watch filtering. The check now runs in every mode. The toolkit's own pages already passed it, so nothing changes for you. Thanks to @thedigitalfox.
Added
- House Arrest keeps a list of your DNS servers. The DNS Lockdown tab now opens with a card for each DNS server your networks are allowed to use. Add each one once, with a name and its type (Pi-hole, AdGuard Home or Other). Pi-hole and AdGuard Home cards link to the server's admin page, at an address you can edit. Each card shows which network the server is on, which networks hand it out through DHCP, and which DNS Lockdowns approve it. On a first visit, the tab offers the DNS servers your networks already hand out. Setting up a DNS Lockdown now means ticking DNS servers instead of typing addresses.
- You choose which DNS server is primary. When DNS Lockdown also points DHCP at your approved DNS servers, they're handed out in the order you tick them, so the first one you tick is the primary. Each ticked server shows its place (1st, 2nd and so on), and the DHCP preview labels every address as primary, secondary, 3rd or 4th before anything is written. To change the order, untick a server and tick it again. Before this, the order was the order you added the servers, and nothing on the page showed it.
Fixed
- DNS Lockdown no longer cuts off a Pi-hole on the network it serves. Locking down the network your Pi-hole or AdGuard Home server lives on also blocked that server's own lookups on the internet, so every device on the network lost DNS. DNS Lockdown now adds a rule that lets that DNS server keep looking names up, and the tab says so before you review. The lockdown list also showed only some of the approved DNS servers when a lockdown had both local and internet ones. It now shows all of them.
- DNS Lockdown is no longer offered on VPN networks. The list of networks to lock down included Site Magic and other VPN networks, which hand out no DHCP and aren't covered by the rules DNS Lockdown writes. DNS Lockdown now lists only LAN and guest networks, and the current DNS table on the tab does the same.
- House Arrest's mDNS switch works on sites with a VPN network. When the Gateway mDNS Proxy was set to "All networks", turning mDNS off for one network rebuilt the list from every network except the internet connections, which included Site Magic and other VPN networks. The controller won't put a VPN network on the mDNS list, so it refused the whole change and the switch failed every time with "The controller did not apply the mDNS scope change." The list now only includes local networks. The mDNS cell is no longer offered as a switch on VPN and transit networks, for the same reason.
- A failed lockdown can no longer leave a device cut off (#155). When a Quarantine or Internet only lockdown with the neighbour block failed partway through, House Arrest undid it by deleting the switch rules in the order it wrote them, allow before block. If a block then failed to delete, it stayed behind on its own, cutting the device off from the gateway with nothing on the Devices tab to show why. Undoing a lockdown now follows the same rules as releasing one: blocks go first, and if one can't be removed House Arrest stops, keeps the lockdown visible so you can release it, and names every rule still on your console. Thanks to @technicalanxiety.
- Threat Watch says when it can't reach your console. When the toolkit couldn't connect, Threat Watch showed "UniFi Gateway Required" and said your site seemed to have no gateway. If the connection broke after the page had loaded once, such as when an API key was deleted or replaced in UniFi, it showed nothing at all, and an empty event list looked like a quiet day. Threat Watch now shows "Can't reach your UniFi console" with the reason, for example that the console refused the API key, within a minute of the connection failing. Events collected earlier stay listed.
- The reverse proxy settings are explained properly (#154).
.env.exampledescribedDOMAINas production only, but every mode uses it to accept requests. Neither it nor the README said thatDOMAINandALLOWED_HOSTSneed the exact hostname you type in the browser, so a base domain or a proxy's IP address led to "Host header not allowed" errors. Both now say so. Thanks to @gingerbread-dude. - The U6 Pro is no longer called a U6 Mesh Pro. Its model code (
UAP6MP) was mapped to the wrong name, so Network Pulse and Debug Info showed a U6 Pro as a "U6 Mesh Pro". The real U6 Mesh Pro (U6MP) and U6 Mesh (U6M) codes were missing and are now named too. - Wi-Fi Stalker updates live again (#147). The page connected for live updates to an address the app never answered, so every attempt was refused, it retried every 5 seconds, and connects, disconnects and roams only showed up on the 60-second refresh. Wi-Fi Stalker now answers live connections the same way Network Pulse does. Thanks to @Voxvalve for finding the cause, and @viennatech.
- Threat Watch recognises the UDR 5G Max (#149). Its model code (
UDMA6B9) was missing from the IDS/IPS-capable list, so Threat Watch said the gateway didn't support IPS. Thanks to @twolf218. - Gateways with built-in Wi-Fi count as access points (#150). On a UDR, UDR7, UDR 5G Max or an Express running as gateway, the built-in radios were left out of the AP count on the dashboard and the AP list in Network Pulse. They're now included, and the device is still shown as your gateway. Thanks to @twolf218.
Full details in CHANGELOG.md.