Skip to content

[Enhancement] Simplify security model - reject all non-localhost IP traffic by default #11

Closed
#1270
Closed
[Enhancement] Simplify security model - reject all non-localhost IP traffic by default#11
#1270
Assignees
Mossakacopilot-swe-agent
Labels
enhancementNew feature or request

Description

@Mossaka
Mossaka
opened on Oct 24, 2025

Priority

Medium

Description

The current firewall mixes domain-based allowlisting (Squid) with IP-based exceptions (DNS servers, Squid IP), creating complexity and potential bypass opportunities. A simpler model would be more secure and easier to reason about.

Current approach

  • Domain allowlist → Squid ACLs (HTTP/HTTPS)
  • IP exceptions: Squid proxy, DNS servers (any IP on port 53), localhost
  • Then reject everything else

Problems

  1. DNS allowed to any IP on port 53 (see [Security] DNS queries allowed to any IP on port 53 (data exfiltration risk) #9)
  2. Mixed security models are harder to audit
  3. Non-HTTP protocols need IP-based rules anyway

Proposed approach

✅ ALLOW: localhost (127.0.0.0/8) - for stdio MCP servers
✅ ALLOW: Squid proxy IP (172.30.0.10) - single egress point
❌ REJECT: Everything else

Benefits

  • Squid handles all DNS lookups internally (no container DNS needed)
  • Single security boundary: Squid domain allowlist
  • Simpler iptables rules
  • No IP-based exceptions to audit
  • Forces all traffic through proxy (except localhost)

Implementation changes

  • src/host-iptables.ts: Remove DNS exception rules (lines 181-192)
  • containers/copilot/setup-iptables.sh: Remove DNS NAT exceptions (lines 29-37)
  • Configure Squid to handle DNS internally
  • Test that Squid can resolve domains without container doing its own DNS

Potential issues

  • Need to verify Squid can handle all DNS without container-level DNS
  • May need to configure Squid DNS servers explicitly
  • Impact on stdio MCP servers that need DNS (probably none if they use localhost)

Related to

Issue #9 (DNS restriction)

Activity

  1. Mossaka
    added
    enhancementNew feature or request
    on Oct 24, 2025

  2. github-actions commented on Jan 17, 2026

    @github-actions
    github-actionsbot
    on Jan 17, 2026 – with GitHub Actions
    Contributor

    🍪 Issue Monster has assigned this to Copilot!

    I've identified this issue as a good candidate for automated resolution and assigned it to the Copilot agent.

    The Copilot agent will analyze the issue and create a pull request with the fix.

    Om nom nom! 🍪

    AI generated by Issue Monster

  3. github-actions commented on Jan 18, 2026

    @github-actions
    github-actionsbot
    on Jan 18, 2026 – with GitHub Actions
    Contributor

    🍪 Issue Monster has assigned this to Copilot!

    I've identified this issue as a good candidate for automated resolution and assigned it to the Copilot agent.

    The Copilot agent will analyze the issue and create a pull request with the fix.

    Om nom nom! 🍪

    AI generated by Issue Monster

  4. github-actions commented on Jan 18, 2026

    @github-actions
    github-actionsbot
    on Jan 18, 2026 – with GitHub Actions
    Contributor

    🍪 Issue Monster has assigned this to Copilot!

    I've identified this issue as a good candidate for automated resolution and assigned it to the Copilot agent.

    The Copilot agent will analyze the issue and create a pull request with the fix.

    Om nom nom! 🍪

    AI generated by Issue Monster

  5. github-actions commented on Jan 18, 2026

    @github-actions
    github-actionsbot
    on Jan 18, 2026 – with GitHub Actions
    Contributor

    🍪 Issue Monster has assigned this to Copilot!

    I've identified this issue as a good candidate for automated resolution and assigned it to the Copilot agent.

    The Copilot agent will analyze the issue and create a pull request with the fix.

    Om nom nom! 🍪

    AI generated by Issue Monster

  6. github-actions commented on Jan 18, 2026

    @github-actions
    github-actionsbot
    on Jan 18, 2026 – with GitHub Actions
    Contributor

    🍪 Issue Monster has assigned this to Copilot!

    I've identified this issue as a good candidate for automated resolution and assigned it to the Copilot agent.

    The Copilot agent will analyze the issue and create a pull request with the fix.

    Om nom nom! 🍪

    AI generated by Issue Monster

  7. github-actions commented on Jan 18, 2026

    @github-actions
    github-actionsbot
    on Jan 18, 2026 – with GitHub Actions
    Contributor

    🍪 Issue Monster has assigned this to Copilot!

    I've identified this issue as a good candidate for automated resolution and assigned it to the Copilot agent.

    The Copilot agent will analyze the issue and create a pull request with the fix.

    Om nom nom! 🍪

    AI generated by Issue Monster

  8. github-actions commented on Jan 18, 2026

    @github-actions
    github-actionsbot
    on Jan 18, 2026 – with GitHub Actions
    Contributor

    🍪 Issue Monster has assigned this to Copilot!

    I've identified this issue as a good candidate for automated resolution and assigned it to the Copilot agent.

    The Copilot agent will analyze the issue and create a pull request with the fix.

    Om nom nom! 🍪

    AI generated by Issue Monster

  9. github-actions commented on Jan 18, 2026

    @github-actions
    github-actionsbot
    on Jan 18, 2026 – with GitHub Actions
    Contributor

    🍪 Issue Monster has assigned this to Copilot!

    I've identified this issue as a good candidate for automated resolution and assigned it to the Copilot agent.

    The Copilot agent will analyze the issue and create a pull request with the fix.

    Om nom nom! 🍪

    AI generated by Issue Monster

  10. github-actions commented on Jan 18, 2026

    @github-actions
    github-actionsbot
    on Jan 18, 2026 – with GitHub Actions
    Contributor

    🍪 Issue Monster has assigned this to Copilot!

    I've identified this issue as a good candidate for automated resolution and assigned it to the Copilot agent.

    The Copilot agent will analyze the issue and create a pull request with the fix.

    Om nom nom! 🍪

    AI generated by Issue Monster

  11. github-actions commented on Jan 18, 2026

    @github-actions
    github-actionsbot
    on Jan 18, 2026 – with GitHub Actions
    Contributor

    🍪 Issue Monster has assigned this to Copilot!

    I've identified this issue as a good candidate for automated resolution and assigned it to the Copilot agent.

    The Copilot agent will analyze the issue and create a pull request with the fix.

    Om nom nom! 🍪

    AI generated by Issue Monster

  12. github-actions commented on Jan 18, 2026

    @github-actions
    github-actionsbot
    on Jan 18, 2026 – with GitHub Actions
    Contributor

    🍪 Issue Monster has assigned this to Copilot!

    I've identified this issue as a good candidate for automated resolution and assigned it to the Copilot agent.

    The Copilot agent will analyze the issue and create a pull request with the fix.

    Om nom nom! 🍪

    AI generated by Issue Monster

  13. github-actions commented on Jan 18, 2026

    @github-actions
    github-actionsbot
    on Jan 18, 2026 – with GitHub Actions
    Contributor

    🍪 Issue Monster has assigned this to Copilot!

    I've identified this issue as a good candidate for automated resolution and assigned it to the Copilot agent.

    The Copilot agent will analyze the issue and create a pull request with the fix.

    Om nom nom! 🍪

    AI generated by Issue Monster

  14. github-actions commented on Jan 18, 2026

    @github-actions
    github-actionsbot
    on Jan 18, 2026 – with GitHub Actions
    Contributor

    🍪 Issue Monster has assigned this to Copilot!

    I've identified this issue as a good candidate for automated resolution and assigned it to the Copilot agent.

    The Copilot agent will analyze the issue and create a pull request with the fix.

    Om nom nom! 🍪

    AI generated by Issue Monster

  15. github-actions commented on Jan 18, 2026

    @github-actions
    github-actionsbot
    on Jan 18, 2026 – with GitHub Actions
    Contributor

    🍪 Issue Monster has assigned this to Copilot!

    I've identified this issue as a good candidate for automated resolution and assigned it to the Copilot agent.

    The Copilot agent will analyze the issue and create a pull request with the fix.

    Om nom nom! 🍪

    AI generated by Issue Monster

  16. 53 remaining items

  17. github-actions commented on Jan 23, 2026

    @github-actions
    github-actionsbot
    on Jan 23, 2026 – with GitHub Actions
    Contributor

    🍪 Issue Monster has assigned this to Copilot!

    I've identified this issue as a good candidate for automated resolution and assigned it to the Copilot agent.

    The Copilot agent will analyze the issue and create a pull request with the fix.

    Om nom nom! 🍪

    AI generated by Issue Monster

  18. github-actions commented on Jan 23, 2026

    @github-actions
    github-actionsbot
    on Jan 23, 2026 – with GitHub Actions
    Contributor

    🍪 Issue Monster has assigned this to Copilot!

    I've identified this issue as a good candidate for automated resolution and assigned it to the Copilot agent.

    The Copilot agent will analyze the issue and create a pull request with the fix.

    Om nom nom! 🍪

    AI generated by Issue Monster

  19. github-actions commented on Jan 23, 2026

    @github-actions
    github-actionsbot
    on Jan 23, 2026 – with GitHub Actions
    Contributor

    🍪 Issue Monster has assigned this to Copilot!

    I've identified this issue as a good candidate for automated resolution and assigned it to the Copilot agent.

    The Copilot agent will analyze the issue and create a pull request with the fix.

    Om nom nom! 🍪

    AI generated by Issue Monster

  20. github-actions commented on Jan 23, 2026

    @github-actions
    github-actionsbot
    on Jan 23, 2026 – with GitHub Actions
    Contributor

    🍪 Issue Monster has assigned this to Copilot!

    I've identified this issue as a good candidate for automated resolution and assigned it to the Copilot agent.

    The Copilot agent will analyze the issue and create a pull request with the fix.

    Om nom nom! 🍪

    AI generated by Issue Monster

  21. github-actions commented on Jan 23, 2026

    @github-actions
    github-actionsbot
    on Jan 23, 2026 – with GitHub Actions
    Contributor

    🍪 Issue Monster has assigned this to Copilot!

    I've identified this issue as a good candidate for automated resolution and assigned it to the Copilot agent.

    The Copilot agent will analyze the issue and create a pull request with the fix.

    Om nom nom! 🍪

    AI generated by Issue Monster

  22. github-actions commented on Jan 23, 2026

    @github-actions
    github-actionsbot
    on Jan 23, 2026 – with GitHub Actions
    Contributor

    🍪 Issue Monster has assigned this to Copilot!

    I've identified this issue as a good candidate for automated resolution and assigned it to the Copilot agent.

    The Copilot agent will analyze the issue and create a pull request with the fix.

    Om nom nom! 🍪

    AI generated by Issue Monster

  23. Mossaka
    assigned
    Copilot
    and
    Mossaka
    on Jan 23, 2026
  24. Mossaka
    added 6 commits that reference this issue on Mar 11, 2026

    fix(security): simplify security model by removing direct DNS exceptions

    f404484

    fix(security): simplify to localhost+Squid-only iptables

    e222134

    fix(security): simplify to localhost+Squid-only iptables

    93c4e67

    fix(security): simplify to localhost+Squid-only iptables

    f89dde1

    fix(security): simplify to localhost+Squid-only iptables

    8de45d5

    fix(security): simplify to localhost+Squid-only iptables

    d9d01cc
  25. Mossaka
    closed this as completedin 5d2ef18on Mar 13, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

enhancementNew feature or request

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions