fix(firewall): remove blanket TCP allow for unpaid clientsfeature/tollgate-core-v2

The sandbox_mint_access=true default allowed ALL TCP forwarding from
unpaid clients, completely bypassing the firewall. Fix:
- Remove the blanket TCP allow when sandbox_mint_access is set
- Only allow traffic to AP IP on specific ports (80, 2121, 4869, mining)
- Allow ICMP to AP IP for diagnostics
- Default sandbox_mint_access to false
- Add port 4869 (local relay) to allowed sandbox ports

Verified on Board B: unpaid clients blocked from internet, local
services (portal, API, relay) still accessible.

2 files changed, 6 insertions, 8 deletions

diff --git a/components/tollgate_core/src/tollgate_core_firewall.c b/components/tollgate_core/src/tollgate_core_firewall.c
index 4f12923..5dbdc7a 100644
--- a/components/tollgate_core/src/tollgate_core_firewall.c
+++ b/components/tollgate_core/src/tollgate_core_firewall.c
@@ -18,7 +18,6 @@
 static const char *TAG = "tg_core_fw";
 static esp_ip4_addr_t s_ap_ip;
 static uint16_t s_mining_port = 3333;
-static bool s_sandbox_mint_access = false;
 
 typedef struct {
     uint32_t ip;
@@ -81,7 +80,7 @@ void tollgate_core_fw_set_sandbox_ports(uint16_t mining_port)
 
 void tollgate_core_fw_set_sandbox_mint_access(bool enabled)
 {
-    s_sandbox_mint_access = enabled;
+    (void)enabled;
 }
 
 static bool is_sandbox_allowed(struct pbuf *p)
@@ -98,17 +97,16 @@ static bool is_sandbox_allowed(struct pbuf *p)
                 struct tcp_hdr *tcphdr = (struct tcp_hdr *)((uint8_t *)p->payload + IP_HLEN);
                 dst_port = lwip_ntohs(tcphdr->dest);
             }
-            if (dst_port == 80 || dst_port == 2121 || dst_port == s_mining_port) {
+            if (dst_port == 80 || dst_port == 2121 || dst_port == 4869 || dst_port == s_mining_port) {
                 return true;
             }
         }
         if (iphdr->_proto == IP_PROTO_UDP) {
             return true;
         }
-    }
-
-    if (s_sandbox_mint_access && iphdr->_proto == IP_PROTO_TCP) {
-        return true;
+        if (iphdr->_proto == 1) {
+            return true;
+        }
     }
 
     return false;
diff --git a/main/config.c b/main/config.c
index 2edb6da..d2c40d6 100644
--- a/main/config.c
+++ b/main/config.c
@@ -45,7 +45,7 @@ esp_err_t tollgate_config_init(void)
     g_config.mining_payout_mode = MINING_PAYOUT_AUTO;
     g_config.stratum_port = 3333;
     g_config.mining_port = 3334;
-    g_config.mining_sandbox_mint_access = true;
+    g_config.mining_sandbox_mint_access = false;
     g_config.market_enabled = true;
     g_config.market_scan_interval_s = 30;
     g_config.client_auto_switch = false;