From 4cb4a9a3535b0718852b83c957c0835a5feb50a2 Mon Sep 17 00:00:00 2001
From: Piyush <piyushgk1@gmail.com>
Date: Tue, 9 Jun 2026 11:15:36 -0700
Subject: [PATCH 1/2] Allow DNS for NTP while blocking WAN

---
 scripts/block_internet_access.sh | 35 +++++++++++++++++++++++++++++++-
 1 file changed, 34 insertions(+), 1 deletion(-)

diff --git a/scripts/block_internet_access.sh b/scripts/block_internet_access.sh
index fa4ecdaa..2685a7ef 100644
--- a/scripts/block_internet_access.sh
+++ b/scripts/block_internet_access.sh
@@ -2,6 +2,38 @@
 
 echo "Blocking internet access..."
 
+allow_dns_to_configured_resolvers() {
+  if [ ! -f /etc/resolv.conf ]; then
+    echo "No /etc/resolv.conf found; skipping DNS firewall allowances."
+    return
+  fi
+
+  echo "Allowing DNS traffic to configured resolvers..."
+  while read -r keyword resolver _; do
+    if [ "$keyword" != "nameserver" ] || [ -z "$resolver" ]; then
+      continue
+    fi
+
+    case "$resolver" in
+      *:*)
+        ip6tables -A OUTPUT -d "$resolver" -p udp --dport 53 -j ACCEPT
+        ip6tables -A INPUT -s "$resolver" -p udp --sport 53 -j ACCEPT
+        ip6tables -A OUTPUT -d "$resolver" -p tcp --dport 53 -j ACCEPT
+        ip6tables -A INPUT -s "$resolver" -p tcp --sport 53 -j ACCEPT
+        ;;
+      *.*)
+        iptables -A OUTPUT -d "$resolver" -p udp --dport 53 -j ACCEPT
+        iptables -A INPUT -s "$resolver" -p udp --sport 53 -j ACCEPT
+        iptables -A OUTPUT -d "$resolver" -p tcp --dport 53 -j ACCEPT
+        iptables -A INPUT -s "$resolver" -p tcp --sport 53 -j ACCEPT
+        ;;
+      *)
+        echo "Skipping unrecognized resolver address: $resolver"
+        ;;
+    esac
+  done < /etc/resolv.conf
+}
+
 # IPv4 Rules
 echo "Configuring IPv4 rules..."
 
@@ -48,6 +80,8 @@ iptables -A OUTPUT -d 172.16.0.0/12 -j ACCEPT
 iptables -A INPUT -s 192.168.0.0/16 -j ACCEPT
 iptables -A OUTPUT -d 192.168.0.0/16 -j ACCEPT
 
+allow_dns_to_configured_resolvers
+
 # Allow NTP traffic - this allows us to synchronize the system time
 iptables -I OUTPUT -p udp --dport 123 -j ACCEPT
 iptables -I INPUT -p udp --sport 123 -j ACCEPT
@@ -95,4 +129,3 @@ ip6tables -A OUTPUT -j DROP
 ip6tables-save > /etc/iptables/ip6tables.rules
 
 echo "Blocked WAN internet access successfully!"
-

From 0642856a37e6828eb78f9d87b8024c8e72be2a6b Mon Sep 17 00:00:00 2001
From: Piyush <piyushgk1@gmail.com>
Date: Tue, 9 Jun 2026 11:23:04 -0700
Subject: [PATCH 2/2] Flush IPv6 rules when unblocking WAN

---
 scripts/unblock_internet_access.sh | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/scripts/unblock_internet_access.sh b/scripts/unblock_internet_access.sh
index c5f53031..152dfdd1 100644
--- a/scripts/unblock_internet_access.sh
+++ b/scripts/unblock_internet_access.sh
@@ -7,4 +7,9 @@ iptables -X
 iptables -t nat -F
 iptables -t nat -X
 
+ip6tables -F
+ip6tables -X
+ip6tables -t nat -F 2>/dev/null || true
+ip6tables -t nat -X 2>/dev/null || true
+
 echo "Unblocked internet access!"