mirrors_public/oddlama_nix-config
1
1
Fork 1
mirror of https://github.com/oddlama/nix-config.git synced 2025-10-11 07:10:39 +02:00
Code Activity

feat(nftables): update to new nftables firewall branch

Browse source
This commit is contained in:
oddlama 2023-10-15 14:10:06 +02:00
parent 051fdc24cb
commit 1f9a28c3db
No known key found for this signature in database
GPG key ID: 14EFE510775FE39A
11 changed files with 48 additions and 100 deletions
Download patch file Download diff file Expand all files Collapse all files

12
hosts/ward/net.nix
View file

@ -95,19 +95,15 @@ in {
};
};
# TODO mkForce nftables
networking.nftables.firewall = {
zones = lib.mkForce {
snippets.nnf-icmp.ipv6Types = ["mld-listener-query" "nd-router-solicit"];
zones = {
untrusted.interfaces = ["wan"];
lan.interfaces = ["lan-self"];
};
rules = lib.mkForce {
icmp = {
# accept ipv6 router solicit and multicast listener discovery query
extraLines = ["ip6 nexthdr icmpv6 icmpv6 type { mld-listener-query, nd-router-solicit } accept"];
};
rules = {
masquerade = {
from = ["lan"];
to = ["untrusted"];