Cloonar/nixos
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

add vserver

Browse Source
This commit is contained in:
Dominik Polakovics Polakovics
2023-12-04 13:11:05 +01:00
parent 70e9e79717
commit 35c8bbb1ac
2 changed files with 6 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
hosts/fw.cloonar.com/modules/firewall.nix
View File

@@ -127,6 +127,7 @@
iifname { iifname {
"wan", # disable when final "wan", # disable when final
"server", "server",
"vserver",
"lan", "lan",
"wg_cloonar" "wg_cloonar"
} counter accept } counter accept
@@ -135,8 +136,7 @@
iifname { iifname {
"lan", "lan",
"server", "server",
"vb-*", "vserver",
"podman0",
"infrastructure", "infrastructure",
"wg_cloonar", "wg_cloonar",
"smart", "smart",
@@ -145,7 +145,7 @@
iifname { iifname {
"lan", "lan",
"server", "server",
"podman0", "vserver",
"vb-*", "vb-*",
"infrastructure", "infrastructure",
"wg_cloonar", "wg_cloonar",
@@ -177,16 +177,15 @@
# lan and vpn to any # lan and vpn to any
# TODO: disable wan when finished # TODO: disable wan when finished
iifname { "wan", "lan", "server", "vb-*", "podman0", "wg_cloonar" } oifname { "lan", "vb-*", "server", "podman0", "infrastructure", "multimedia", "smart", "wrwks", "wg_cloonar", "wg_epicenter", "wg_ghetto_at" } counter accept iifname { "wan", "lan", "server", "vserver", "wg_cloonar" } oifname { "lan", "vb-*", "server", "vserver", "infrastructure", "multimedia", "smart", "wrwks", "wg_cloonar", "wg_epicenter", "wg_ghetto_at" } counter accept
iifname { "infrastructure" } oifname { "podman0", "vb-omada" } counter accept iifname { "infrastructure" } oifname { "server", "vserver" } counter accept
# Allow trusted network WAN access # Allow trusted network WAN access
iifname { iifname {
"lan", "lan",
"infrastructure", "infrastructure",
"vb-*",
"server", "server",
"podman0", "vserver",
"multimedia", "multimedia",
"smart", "smart",
"wg_cloonar", "wg_cloonar",

1
hosts/fw.cloonar.com/modules/unbound.nix
View File

@@ -11,7 +11,6 @@
"10.42.98.0/24 allow" "10.42.98.0/24 allow"
"10.42.99.0/24 allow" "10.42.99.0/24 allow"
"10.42.101.0/24 allow" "10.42.101.0/24 allow"
"10.42.254.0/24 allow"
]; ];
tls-cert-bundle = "/var/lib/acme/fw.cloonar.com/fullchain.pem"; tls-cert-bundle = "/var/lib/acme/fw.cloonar.com/fullchain.pem";
local-zone = "\"cloonar.com\" transparent"; local-zone = "\"cloonar.com\" transparent";