Cloonar/nixos
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

fix firewall rules

Browse source
This commit is contained in:
Dominik Polakovics Polakovics 2023-12-01 18:19:41 +01:00
parent 579b768230
commit aed7c73032
1 changed files with 8 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

16
hosts/fw.cloonar.com/modules/firewall.nix
View file

@ -1,6 +1,6 @@
{ ... }: {
networking = {
nat.enable = false;
nat.enable = true;
firewall = {
enable = true;
extraCommands = ''
@ -8,16 +8,16 @@
iptables -A INPUT -i wan -j ACCEPT
iptables -A INPUT -i lan -j ACCEPT
iptables -A INPUT -i wg_cloonar -j ACCEPT
iptables -A INPUT -p udp -i smart --dports 53,67,68 -j ACCEPT
iptables -A INPUT -p udp -i multimedia --dports 53,67,68 -j ACCEPT
iptables -A INPUT -p tcp -i smart --dports 80,443,453 -j ACCEPT
iptables -A INPUT -p tcp -i multimedia --dports 80,443,453 -j ACCEPT
iptables -A INPUT -p udp -i smart -m multiport --dports 53,67,68 -j ACCEPT
iptables -A INPUT -p udp -i multimedia -m multiport --dports 53,67,68 -j ACCEPT
iptables -A INPUT -p tcp -i smart -m multiport --dports 80,443,453 -j ACCEPT
iptables -A INPUT -p tcp -i multimedia -m multiport --dports 80,443,453 -j ACCEPT
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i wan -d 10.42.0.0/24 -j ACCEPT
iptables -A FORWARD -i lan -d 10.42.0.0/24 -j ACCEPT
iptables -A FORWARD -i wg_cloonar -d 10.42.0.0/24 -j ACCEPT
iptables -A FORWARD -i wan -d 10.42.0.0/16 -j ACCEPT
iptables -A FORWARD -i lan -d 10.42.0.0/16 -j ACCEPT
iptables -A FORWARD -i wg_cloonar -d 10.42.0.0/16 -j ACCEPT
iptables -A FORWARD -i lan -o wan -j ACCEPT
iptables -A FORWARD -i server -o wan -j ACCEPT