What would be the correct iptable entries ?

[nehasjains]

Sorry, if this is off-topic.....

I have a very basic knowledge to networking and linux. I want to allow access to homeassistant for only some machines on my network. For this I am using iptable with the below entries.

-A INPUT -i lo -j ACCEPT
-A INPUT -s 192.168.1.9/32 -p tcp --dport 8123 -j ACCEPT
-A INPUT -s 192.168.1.10/32 -p tcp --dport 8123 -j ACCEPT
-A INPUT -s 192.168.1.13/32 -p tcp --dport 8123 -j ACCEPT
-A INPUT -s 192.168.1.14/32 -p tcp --dport 8123 -j ACCEPT
-A INPUT -p tcp --dport 8123 -j DROP

Now this is working perfectly.

But I am not able to start the add-on “Home-Assistant-Matter-Hub”.
If I remove the last line in my iptable i.e. “-A INPUT -p tcp --dport 8123 -j DROP” then the add-on starts.

I know I am missing something. But with my limited knowledge of networking and linux. I have no clue how to fix this.

@t0bst4r What should be the correct iptable entry to make this add-on start? I would really appreciate your help and guidance.

Kindly help.

Home-assistant is running on docker Rasp pi 4 Debian bookworm.

[t0bst4r]

Hi @nehasjains ,
do you have any error logs?
If its the first time starting the addon you won't have any matter bridges. So the problem already starts with the Web UI.

The addon uses port 8482 for the web ui. This web ui is unprotected. So it has no username/password. But when we add ingress-support (#36), this will not be required, cause it will be proxied by HA authentication.

Additionally every bridge you'll create using this addon will need a port for matter (default port for one bridge is 5540). It needs tcp & udp and some additional features like mDNS.

Anyway you first need to get the addon starting, THEN you can trial & error with matter.

@Apollon77 Do you have any more suggestions in advance?

[nehasjains]

-----------------------------------------------------------
 Add-on: Home-Assistant-Matter-Hub
 Publish your entities from Home Assistant to any Matter-compatible controller like Alexa, Apple Home or Google Home.
-----------------------------------------------------------
 Add-on version: 3.0.0-alpha.26
 You are running the latest version of this add-on.
 System: Debian GNU/Linux 12 (bookworm)  (aarch64 / raspberrypi4-64)
 Home Assistant Core: 2024.11.1
 Home Assistant Supervisor: 2024.11.2
-----------------------------------------------------------
 Please, share the above information when looking for help
 or support in, e.g., GitHub, forums or the Discord chat.
-----------------------------------------------------------
s6-rc: info: service base-addon-banner successfully started
s6-rc: info: service fix-attrs: starting
s6-rc: info: service base-addon-log-level: starting
s6-rc: info: service fix-attrs successfully started
s6-rc: info: service base-addon-log-level successfully started
s6-rc: info: service legacy-cont-init: starting
s6-rc: info: service legacy-cont-init successfully started
s6-rc: info: service legacy-services: starting
s6-rc: info: service legacy-services successfully started
[ 2024-11-12T08:26:27.422Z ] [ INFO  ] [ Storage                                            ]: Storage location: /config/data
[ 2024-11-12T08:26:27.471Z ] [ DEBUG ] [ matter.js / UdpChannelNode                         ]: Socket created and bound remoteAddress: undefined:5353 localAddress: 0.0.0.0:5353
[ 2024-11-12T08:26:27.481Z ] [ DEBUG ] [ matter.js / UdpChannelNode                         ]: Socket created and bound remoteAddress: undefined:5353 localAddress: :::5353
[ 2024-11-12T08:26:27.490Z ] [ DEBUG ] [ matter.js / UdpChannelNode                         ]: Socket created and bound remoteAddress: undefined:5353 localAddress: 0.0.0.0:5353
[ 2024-11-12T08:26:27.497Z ] [ DEBUG ] [ matter.js / UdpChannelNode                         ]: Socket created and bound remoteAddress: undefined:5353 localAddress: :::5353
home-assistant-matter-hub start
start the application
Options:
  --help                         Show help                             [boolean]
  --log-level
  [string] [choices: "silly", "debug", "info", "warn", "error"] [default: "info"
                                                                               ]
  --disable-log-colors                                [boolean] [default: false]
  --storage-location             Path to a directory where the application shoul
                                 d store its data. Defaults to $HOME/.home-assis
                                 tant-matter-hub                        [string]
  --web-port                     Port used by the web application
                                                        [number] [default: 8482]
  --mdns-network-interface       Limit MDNS to this network interface   [string]
  --home-assistant-url           The HTTP-URL of your Home Assistant URL
                                                             [string] [required]
  --home-assistant-access-token  A long-lived access token for your Home Assista
                                 nt Instance                 [string] [required]
1
s6-rc: info: service legacy-services: stopping
s6-rc: info: service legacy-services successfully stopped
s6-rc: info: service legacy-cont-init: stopping
s6-rc: info: service legacy-cont-init successfully stopped
s6-rc: info: service fix-attrs: stopping
s6-rc: info: service base-addon-log-level: stopping
s6-rc: info: service fix-attrs successfully stopped
s6-rc: info: service base-addon-log-level successfully stopped
s6-rc: info: service base-addon-banner: stopping
s6-rc: info: service base-addon-banner successfully stopped
s6-rc: info: service s6rc-oneshot-runner: stopping
s6-rc: info: service s6rc-oneshot-runner successfully stopped

I have included two new rules in iptable

A INPUT -i lo -j ACCEPT
-A INPUT -s 192.168.1.9/32 -p tcp --dport 8123 -j ACCEPT
-A INPUT -s 192.168.1.10/32 -p tcp --dport 8123 -j ACCEPT
-A INPUT -s 192.168.1.13/32 -p tcp --dport 8123 -j ACCEPT
-A INPUT -s 192.168.1.14/32 -p tcp --dport 8123 -j ACCEPT
-A INPUT -s 192.168.1.15/32 -p tcp --dport 8482 -j ACCEPT ##new rule
-A INPUT -s 192.168.1.15/32 -p tcp --dport 5540 -j ACCEPT ##new rule
-A INPUT -p tcp --dport 8123 -j DROP

Yes the add-on works fine and one matter bridge is commissioned also, but one when -A INPUT -p tcp --dport 8123 -j DROP rule is omitted from the iptable.

I have no clue what would be the correct entry/entries to make the add-on start and still allowing access to only needed devices to homeassistant.

[t0bst4r]

I think matter uses TCP and UDP.
Additionally it uses Port 5353 for mDNS, too (UDP and TCP).

In the future they will probably do broadcasting as well which will require some more. But for now that should be all.

[Apollon77]

matter uses UDP on ports 5353 and usually 5540, but the latter port is not really hard defined and could also be different because MDNS announcements contain them (5540 is the official IANA assigned port). TCP is not yet used, but will come soon too