Cloonar/nixos
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix firewall

Browse Source
This commit is contained in:
Dominik Polakovics Polakovics
2023-12-03 22:00:07 +01:00
parent 5da0671fc0
commit d764cbde57
2 changed files with 8 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
hosts/fw.cloonar.com/modules/firewall.nix
View File

@@ -70,7 +70,7 @@
# Allow networks to access the dns and dhcp # Allow networks to access the dns and dhcp
iifname { iifname {
"lan", "lan",
"vb-gitea", "ve-gitea",
"podman0", "podman0",
"infrastructure", "infrastructure",
"wg_cloonar", "wg_cloonar",
@@ -80,7 +80,7 @@
iifname { iifname {
"lan", "lan",
"podman0", "podman0",
"vb-gitea", "ve-gitea",
"infrastructure", "infrastructure",
"wg_cloonar", "wg_cloonar",
"smart", "smart",
@@ -111,14 +111,14 @@
# lan and vpn to any # lan and vpn to any
# TODO: disable wan when finished # TODO: disable wan when finished
iifname { "wan", "lan", "vb-gitea", "podman0", "wg_cloonar" } oifname { "lan", "vb-gitea", "podman0", "infrastructure", "multimedia", "smart", "wrwks", "wg_cloonar", "wg_epicenter", "wg_ghetto_at" } counter accept iifname { "wan", "lan", "ve-gitea", "podman0", "wg_cloonar" } oifname { "lan", "ve-gitea", "podman0", "infrastructure", "multimedia", "smart", "wrwks", "wg_cloonar", "wg_epicenter", "wg_ghetto_at" } counter accept
iifname { "infrastructure" } oifname { "podman0", "vb-omada" } counter accept iifname { "infrastructure" } oifname { "podman0", "ve-omada" } counter accept
# Allow trusted network WAN access # Allow trusted network WAN access
iifname { iifname {
"lan", "lan",
"infrastructure", "infrastructure",
"vb-gitea", "ve-gitea",
"podman0", "podman0",
"multimedia", "multimedia",
"smart", "smart",
@@ -134,11 +134,10 @@
type nat hook prerouting priority filter; policy accept; type nat hook prerouting priority filter; policy accept;
} }
# Setup NAT masquerading on the ppp0 interface # Setup NAT masquerading on external interfaces
chain postrouting { chain postrouting {
type nat hook postrouting priority filter; policy accept; type nat hook postrouting priority filter; policy accept;
oifname { "wan", "wrwks", "wg_epicenter", "wg_ghetto_at" } masquerade oifname { "wan", "wrwks", "wg_epicenter", "wg_ghetto_at" } masquerade
# oifname { "wan" } masquerade
} }
} }
''; '';

3
hosts/fw.cloonar.com/modules/gitea.nix
View File

@@ -103,7 +103,8 @@ in
# macvlans = [ "vserver" ]; # macvlans = [ "vserver" ];
privateNetwork = true; privateNetwork = true;
hostBridge = "server"; hostBridge = "server";
localAddress = "10.42.97.2/24"; hostAddress = "10.42.97.1"
localAddress = "10.42.97.2";
bindMounts = { bindMounts = {
"/var/lib/gitea" = { "/var/lib/gitea" = {
hostPath = "/var/lib/gitea/"; hostPath = "/var/lib/gitea/";