Firewall rules

[hellodword]

There is severe internet censorship in certain countries around the world; people should use proxy servers to access foreign domains.

Meanwhile, anytype uses P2P technology. Therefore, what are the minimal firewall rules needed to allow P2P connections to work while ensuring that all other egress connections are proxied?

[hellodword]

For example, these are some domains/ports I captured:

sentry.anytype.io:443
telemetry.anytype.io:443

prod-any-sync-nsnode2.anyclub.org:5430
prod-any-sync-node6.anyclub.org:5430

prod-any-sync-filenode2.anyclub.org:5430

prod-any-sync-ppnode2.anyclub.org:5430

graylog.anytype.io:6888

[fb929]

1. to ensure synchronization with the server, access to the following domains/ports must be provided:

prod-any-sync-consensusnode1.anyclub.org:443
prod-any-sync-consensusnode1.anyclub.org:1443
prod-any-sync-consensusnode2.anyclub.org:443
prod-any-sync-consensusnode2.anyclub.org:1443
prod-any-sync-consensusnode3.anyclub.org:443
prod-any-sync-consensusnode3.anyclub.org:1443
prod-any-sync-coordinator1.anyclub.org:443
prod-any-sync-coordinator1.anyclub.org:1443
prod-any-sync-coordinator2.anyclub.org:443
prod-any-sync-coordinator2.anyclub.org:1443
prod-any-sync-coordinator3.anyclub.org:443
prod-any-sync-coordinator3.anyclub.org:1443
prod-any-sync-filenode1.anyclub.org:443
prod-any-sync-filenode1.anyclub.org:1443
prod-any-sync-filenode2.anyclub.org:443
prod-any-sync-filenode2.anyclub.org:1443
prod-any-sync-filenode3.anyclub.org:443
prod-any-sync-filenode3.anyclub.org:1443
prod-any-sync-node1.anyclub.org:443
prod-any-sync-node1.anyclub.org:1443
prod-any-sync-node2.anyclub.org:443
prod-any-sync-node2.anyclub.org:1443
prod-any-sync-node3.anyclub.org:443
prod-any-sync-node3.anyclub.org:1443
prod-any-sync-node4.anyclub.org:443
prod-any-sync-node4.anyclub.org:1443
prod-any-sync-node5.anyclub.org:443
prod-any-sync-node5.anyclub.org:1443
prod-any-sync-node6.anyclub.org:443
prod-any-sync-node6.anyclub.org:1443
prod-any-sync-node7.anyclub.org:443
prod-any-sync-node7.anyclub.org:1443
prod-any-sync-node8.anyclub.org:443
prod-any-sync-node8.anyclub.org:1443
prod-any-sync-node9.anyclub.org:443
prod-any-sync-node9.anyclub.org:1443
prod-any-sync-node10.anyclub.org:443
prod-any-sync-node10.anyclub.org:1443
prod-any-sync-node11.anyclub.org:443
prod-any-sync-node11.anyclub.org:1443
prod-any-sync-node12.anyclub.org:443
prod-any-sync-node12.anyclub.org:1443
prod-any-sync-node13.anyclub.org:443
prod-any-sync-node13.anyclub.org:1443
prod-any-sync-node14.anyclub.org:443
prod-any-sync-node14.anyclub.org:1443
prod-any-sync-node15.anyclub.org:443
prod-any-sync-node15.anyclub.org:1443
prod-any-sync-nsnode1.anyclub.org:443
prod-any-sync-nsnode1.anyclub.org:1443
prod-any-sync-nsnode2.anyclub.org:443
prod-any-sync-nsnode2.anyclub.org:1443
prod-any-sync-ppnode1.anyclub.org:443
prod-any-sync-ppnode1.anyclub.org:1443
prod-any-sync-ppnode2.anyclub.org:443
prod-any-sync-ppnode2.anyclub.org:1443
quic://prod-any-sync-consensusnode1.anyclub.org:5430
quic://prod-any-sync-consensusnode2.anyclub.org:5430
quic://prod-any-sync-consensusnode3.anyclub.org:5430
quic://prod-any-sync-coordinator1.anyclub.org:5430
quic://prod-any-sync-coordinator2.anyclub.org:5430
quic://prod-any-sync-coordinator3.anyclub.org:5430
quic://prod-any-sync-filenode1.anyclub.org:5430
quic://prod-any-sync-filenode2.anyclub.org:5430
quic://prod-any-sync-filenode3.anyclub.org:5430
quic://prod-any-sync-node1.anyclub.org:5430
quic://prod-any-sync-node2.anyclub.org:5430
quic://prod-any-sync-node3.anyclub.org:5430
quic://prod-any-sync-node4.anyclub.org:5430
quic://prod-any-sync-node5.anyclub.org:5430
quic://prod-any-sync-node6.anyclub.org:5430
quic://prod-any-sync-node7.anyclub.org:5430
quic://prod-any-sync-node8.anyclub.org:5430
quic://prod-any-sync-node9.anyclub.org:5430
quic://prod-any-sync-node10.anyclub.org:5430
quic://prod-any-sync-node11.anyclub.org:5430
quic://prod-any-sync-node12.anyclub.org:5430
quic://prod-any-sync-node13.anyclub.org:5430
quic://prod-any-sync-node14.anyclub.org:5430
quic://prod-any-sync-node15.anyclub.org:5430
quic://prod-any-sync-nsnode1.anyclub.org:5430
quic://prod-any-sync-nsnode2.anyclub.org:5430
quic://prod-any-sync-ppnode1.anyclub.org:5430
quic://prod-any-sync-ppnode2.anyclub.org:5430

quic - it's UDP, all other is TCP.
at a minimum, at least one server of each type must be accessible.

2. for the operation of statistics and client log collection, access to the following domains/ports must be provided:

sentry.anytype.io:443
telemetry.anytype.io:443
graylog.anytype.io:6888
amplitude.anytype.io:443

3. for local P2P synchronization:
   clients must be on the same local network, and mDNS should be enabled to allow direct connections between hosts.

[hellodword]

Thanks!

Found nodes in https://github.com/anyproto/anytype-heart/blob/main/core/anytype/config/nodes/production.yml

And I filed a FR about the P2P/mDNS: https://github.com/anyproto/anytype-heart/issues/1341