Network Endpoint Controls

Network Endpoint Controls

AISMixer and nmea_sproxy both expose small network-boundary controls. These controls complement firewall and routing policy; they do not replace it.

AISMixer Ingress ACLs

AISMixer supports input-level allow-lists on both direct UDP and UDPSEC listeners:

udp_inputs:
  - id: roof_receiver
    listen_ip: "0.0.0.0"
    listen_port: 17778
    allow_from:
      - 192.0.2.15
      - 198.51.100.0/24

sec_inputs:
  - id: secure_stations
    listen_ip: "::"
    listen_port: 29999
    allow_from:
      - 2001:db8:42::/64
      - 203.0.113.44

Semantics:

• omitted allow_from means no application-level ACL;
• allow_from: [] denies all packets;
• entries must be literal IP addresses or CIDR networks;
• hostnames are rejected;
• malformed entries fail startup validation;
• allow_from: null is invalid;
• IPv4-mapped IPv6 peers are normalized before matching.

AISMixer Egress Source Binding

forwarders:
  - id: aishub
    host: feed.example.net
    port: 10110
    source_ip: 192.0.2.15

Semantics:

• omitted source_ip means the operating system selects the source address;
• source_ip must be a literal IPv4 or IPv6 address;
• hostnames and CIDR values are rejected;
• source_ip: null is invalid;
• the source port remains automatically selected;
• source_ip selects the socket address family;
• destination hostname resolution is constrained to that family;
• literal destination addresses must match that family.

source_ip does not select an interface, select a routing table, apply a socket mark, or implement SDN behavior.

nmea_sproxy Local Ingress

For the legacy local UDP input, nmea_sproxy supports top-level allow_from:

listen_ip: "::"
listen_port: 50000
allow_from:
  - 192.0.2.15
  - 198.51.100.0/24

The semantics match AISMixer ingress ACLs: omitted means unrestricted, empty list denies all, entries must be literal IP addresses or CIDR networks, and malformed entries fail startup validation.

allow_from applies only to the legacy local UDP input. It is rejected when input.type: serial is configured.

nmea_sproxy Egress Source Binding

Legacy UDPSEC output uses top-level source_ip:

remote_host: mixer.example.net
remote_port: 19999
source_ip: 192.0.2.20

Explicit output mappings use output.source_ip for either UDPSEC or plain UDP:

output:
  type: udp
  host: 192.168.10.20
  port: 17777
  source_ip: 192.168.10.15

The same source-binding semantics apply: omitted lets the OS choose, the value must be a literal IP address, the source port is automatic, and hostname resolution is constrained to the selected family.

In UDPSEC mode, AISMixer pins the session to the observed remote address and port. A changed source IP or source port requires a new handshake.