Firewall-like filtering of connecting nodes

[matrss]

With yggdrasil a firewall can be used to limit incoming connections to specific nodes. Is there any way to do something comparable with yggstack?

The only possibly related configuration option I could find is AllowedPublicKeys, but yggdrasil's genconf output contains this warning for the option:

WARNING: THIS IS NOT A FIREWALL and DOES NOT limit who can reach
open ports or services running on your machine!

(yggstack on the other hand does not include that warning, so maybe it does act like a firewall for yggstack? If yes it would be nice to make that explicit.)

[basilgello]

You can limit the port exposure using yggstack plus AllowedPublicKeys to restrict which nodes can peer with your node. So yggstack is more flexible in terms of security than 'plain' yggdrasil.

[matrss]

Hmm, I've now tested this:

Node 1 runs yggstack and exposes 127.0.0.1:12345 (which is just a simple http server serving a directory) on port 12345 and has one public key set in AllowedPublicKeys, which is not the public key of node 2.

Node 2 runs yggstack and exposes a local socks server.

Both nodes have one of the public yggdrasil peers set.

A curl on node 2 through the socks proxy is now able to reach the http server and get the directory listing.

This suggests to me that AllowedPublicKeys in fact does not limit port exposure, and therefore doesn't act like any kind of firewall, right? The warning from yggdrasil seems to apply just as well.

[basilgello]

Port exposure is controlled by CLI options - with yggdrasil, everything listening on [::] is availablefrom ygg side.

[matrss]

Yes, but I don't see a way with yggstack to restrict who can access the exposed port by their public key or IP address; neither in the config file nor in the CLI options. With yggdrasil this could be done using the hosts firewall.

Maybe I am a bit dense, but given the above test scenario how could I restrict the exposed http server such that only node 2 can access it, but not another node 3 that also participates in the yggdrasil network?