Cloonar/nixos
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

make git and bento publicly available

Browse Source
This commit is contained in:
Dominik Polakovics Polakovics
2023-12-06 17:08:05 +01:00
parent 6cfaa64fd2
commit 847ae4a2db
1 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
hosts/fw.cloonar.com/modules/firewall.nix
View File

@@ -156,6 +156,9 @@
# iifname "multimedia" ip saddr <chromecast IP> tcp dport { llmnr } counter accept # iifname "multimedia" ip saddr <chromecast IP> tcp dport { llmnr } counter accept
# iifname "multimedia" ip saddr <chromecast IP> udp dport { mdns, llmnr } counter accept # iifname "multimedia" ip saddr <chromecast IP> udp dport { mdns, llmnr } counter accept
# Accept web to git server
iifname "wan" oifname "server" tcp dst 10.42.97.50 dport { 22, 80, 443 } counter accept
# Allow returning traffic from wg_cloonar and drop everthing else # Allow returning traffic from wg_cloonar and drop everthing else
iifname "wg_cloonar" ct state { established, related } counter accept iifname "wg_cloonar" ct state { established, related } counter accept
iifname "wg_cloonar" drop iifname "wg_cloonar" drop
@@ -172,6 +175,7 @@
iifname "wg_ghetto_at" ct state { established, related } counter accept iifname "wg_ghetto_at" ct state { established, related } counter accept
iifname "wg_ghetto_at" drop iifname "wg_ghetto_at" drop
# Allow returning traffic from wan and drop everthing else
iifname "wan" ct state { established, related } accept comment "Allow established traffic" iifname "wan" ct state { established, related } accept comment "Allow established traffic"
iifname "wan" icmp type { echo-request, destination-unreachable, time-exceeded } counter accept comment "Allow select ICMP" iifname "wan" icmp type { echo-request, destination-unreachable, time-exceeded } counter accept comment "Allow select ICMP"
iifname "wan" counter drop comment "Drop all other unsolicited traffic from wan" iifname "wan" counter drop comment "Drop all other unsolicited traffic from wan"
@@ -213,12 +217,14 @@
table ip nat { table ip nat {
chain prerouting { chain prerouting {
type nat hook prerouting priority filter; policy accept; type nat hook prerouting priority filter; policy accept;
iifname "wan" tcp dport { 22, 80, 443 } dnat to 10.42.97.50
} }
# Setup NAT masquerading on external interfaces # Setup NAT masquerading on external interfaces
chain postrouting { chain postrouting {
type nat hook postrouting priority filter; policy accept; type nat hook postrouting priority filter; policy accept;
oifname { "wan", "wrwks", "wg_epicenter", "wg_ghetto_at" } masquerade oifname { "wan", "wrwks", "wg_epicenter", "wg_ghetto_at" } masquerade
ip daddr 10.42.97.50 masquerade
} }
} }
''; '';