Default local listeners to 127.0.0.1 #7

2026-08-31T23:11:36-05:00

Ghost commented

2026-08-31 23:11:36 -05:00

Closes #3

Local client TCP/UDP listeners and the built-in DNS server bound 0.0.0.0 (:port) with no access control. Anyone who could reach the host could use the tunnel.

Defaults

Client TCP: 127.0.0.1:<local_port> (was :port / all interfaces)
Client UDP: same
Built-in DNS: 127.0.0.1:<listen_port> (no longer an open recursive forwarder on 0.0.0.0 by default)
Generated server config / README examples: listen_address: 127.0.0.1:8080 (was :8080 / :9000, which is all interfaces, not loopback)

Existing server configs that already set listen_address: :9000 or 0.0.0.0:9000 are unchanged — that is an explicit publish bind.

Override (0.0.0.0 must be explicit)

Config: bind_address: 0.0.0.0 (client local TCP/UDP)
Per-rule: tcp://22:0.0.0.0:2222 or tcp://22:127.0.0.1:2222 (targetport:bindhost:localport)
DNS: dns_server.bind_address: 0.0.0.0
Server tunnel: listen_address: 0.0.0.0:9000 (or :9000) when intentionally publishing

AES-GCM TCP framing from #6 is unchanged.

Closes #3 Local client TCP/UDP listeners and the built-in DNS server bound `0.0.0.0` (`:port`) with no access control. Anyone who could reach the host could use the tunnel. ## Defaults - Client TCP: `127.0.0.1:<local_port>` (was `:port` / all interfaces) - Client UDP: same - Built-in DNS: `127.0.0.1:<listen_port>` (no longer an open recursive forwarder on `0.0.0.0` by default) - Generated server config / README examples: `listen_address: 127.0.0.1:8080` (was `:8080` / `:9000`, which is all interfaces, not loopback) Existing server configs that already set `listen_address: :9000` or `0.0.0.0:9000` are unchanged — that is an explicit publish bind. ## Override (0.0.0.0 must be explicit) - Config: `bind_address: 0.0.0.0` (client local TCP/UDP) - Per-rule: `tcp://22:0.0.0.0:2222` or `tcp://22:127.0.0.1:2222` (`targetport:bindhost:localport`) - DNS: `dns_server.bind_address: 0.0.0.0` - Server tunnel: `listen_address: 0.0.0.0:9000` (or `:9000`) when intentionally publishing AES-GCM TCP framing from #6 is unchanged.

Ghost added 1 commit 2026-08-31 23:11:36 -05:00

Default local listeners to 127.0.0.1

CI / check-and-test (pull_request) Successful in 11s

Details

c20398642d

Client TCP/UDP and the built-in DNS server bind loopback unless bind_address or a per-rule host (tcp://22:0.0.0.0:2222) is set. README and generated server examples no longer document :9000/:8080 as if they were localhost-only.

Closes #3

Ghost reviewed 2026-08-31 23:13:42 -05:00

Ghost left a comment

The default is right. Tests actually bind, not just strcmp. That's why this is landing.

Nits, not blockers:

len(addressParts) >= 3 treats every extra-colon string as a client bind. tcp://[::1]:22 as a server target now dies with invalid target port: [ instead of "we don't parse IPv6 server URLs". That URL never worked, but you made the error worse. If the first token isn't a port, it isn't a client bind rule. Say so.

Copying PortForwardRequest field-by-field is correct. BindAddress stays off the wire. Keep it that way.

PR check is green. Master push for #6 is still red on a race in TestImprovedLoadTest. Not this diff. Don't "fix" it by weakening CI.

The default is right. Tests actually bind, not just strcmp. That's why this is landing. Nits, not blockers: `len(addressParts) >= 3` treats every extra-colon string as a client bind. `tcp://[::1]:22` as a server target now dies with `invalid target port: [` instead of "we don't parse IPv6 server URLs". That URL never worked, but you made the error worse. If the first token isn't a port, it isn't a client bind rule. Say so. Copying PortForwardRequest field-by-field is correct. BindAddress stays off the wire. Keep it that way. PR check is green. Master push for #6 is still red on a race in TestImprovedLoadTest. Not this diff. Don't "fix" it by weakening CI.

Ghost merged commit 45778ac528 into master

2026-08-31 23:13:43 -05:00

Ghost deleted branch fix/teleport-3-loopback-bind

2026-08-31 23:13:43 -05:00

Ghost referenced this pull request

2026-08-31 23:23:06 -05:00

Harden config perms and key derivation #8

Ghost referenced this pull request

2026-08-31 23:27:13 -05:00

Harden config perms and key derivation #8

Sign in to join this conversation.