{"action":"opened","issue":{"url":"https://api.github.com/repos/Pterodactyl/Daemon/issues/12","repository_url":"https://api.github.com/repos/Pterodactyl/Daemon","labels_url":"https://api.github.com/repos/Pterodactyl/Daemon/issues/12/labels{/name}","comments_url":"https://api.github.com/repos/Pterodactyl/Daemon/issues/12/comments","events_url":"https://api.github.com/repos/Pterodactyl/Daemon/issues/12/events","html_url":"https://github.com/Pterodactyl/Daemon/issues/12","id":132450455,"number":12,"title":"Cross-Server firewall implementation for Bungeecord networks","user":{"login":"DaneEveritt","id":418376,"avatar_url":"https://avatars.githubusercontent.com/u/418376?v=3","gravatar_id":"","url":"https://api.github.com/users/DaneEveritt","html_url":"https://github.com/DaneEveritt","followers_url":"https://api.github.com/users/DaneEveritt/followers","following_url":"https://api.github.com/users/DaneEveritt/following{/other_user}","gists_url":"https://api.github.com/users/DaneEveritt/gists{/gist_id}","starred_url":"https://api.github.com/users/DaneEveritt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/DaneEveritt/subscriptions","organizations_url":"https://api.github.com/users/DaneEveritt/orgs","repos_url":"https://api.github.com/users/DaneEveritt/repos","events_url":"https://api.github.com/users/DaneEveritt/events{/privacy}","received_events_url":"https://api.github.com/users/DaneEveritt/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/Pterodactyl/Daemon/labels/enhancement","name":"enhancement","color":"84b6eb"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2016-02-09T15:37:06Z","updated_at":"2016-02-09T15:37:06Z","closed_at":null,"body":"So there is a fundamental issue with running Bungeecord networks within the panel and using this daemon. Servers running on the same physical machine need to be firewalled to only allow connections from local containers, the easiest way to do this is by running them on the `docker0` interface which is local to docker.\r\n\r\nHowever, there are two issues with this setup:\r\n1. Anyone else on that network could configure their Bungee instance to redirect players to a server that isn't theirs on the network potentially causing other issues since players aren't being routed though the core bungee server (effectively MITM).\r\n2. External connections if server isn't run on a local IP since the daemon does not currently configure any type of firewall.\r\n3. Bungee instance on one physical server and the actual servers on a different physical server: how do we network this properly over public IPs. We would need to add firewall rules to handle this properly."}}