Restrict acces to relay status to only necessary hosts

Support
1

The access to my relay status (JSON data on HTTP port 22070) was previously restricted on my firewall to host fsn-k8s.syncthing.net (resolved to 3 IPv4 and 3 IPv6). This host was sufficient to make the relay appear on https://relays.syncthing.net/.

I do this because I don’t want extra data of my relay to be accessible to the entire world (relay version, …).

For the past few days, the host fsn-k8s.syncthing.net does not resolves anymore (DNS name does not exists). The relay list stopped to show my relay status.

I had to capture some traffic on port 22070 to get one of the new addresses that query the relay status. It seems now to be only 142.132.227.186 (static.186.227.132.142.clients.your-server.de).

Is there a host name pointing to this host, so that I will not have to update my firewall rules in the future ? (*.syncthing.net or any other host name)

This does not requires static IP addresses, just a persistent host name pointing to servers querying relays statuses regardless of any future changes.

2

The host querying relays on port tcp/22070 seems to be back to fsn-k8s.syncthing.net.

I don’t know why this host was offline during a few days, and why another single host was requesting relays during this time.

3

I was rebuilding the cluster and migrating services to a temporary set of hosts and back.

4

I think if you want to restrict to a single relay you should run your own relay. It’s not reasonable to expect any one single relay from the include list to be up all the time. The point is multiple relays are available and if one goes down for whatever reason others will be up and pick up the link.

5

What you say has nothing to do with this subject… :thinking:

It was only about the Syncthing servers (fsn-k8s.syncthing.net) querying relays status on port tcp/22070 :