nixos

commit 252432c59b198591994b2fa813164fbd9bcf1a47
parent 490d7f32e3b4f195da391be4cbefd57c70cd021d
Author: MTRNord <mtrnord1@gmail.com>
Date:   Sun, 28 Jan 2024 00:34:18 +0100

Debug

Diffstat:
M
nixos/worker-1/configuration.nix
 | 
11
++++++++++-
M
nixos/worker-2/configuration.nix
 | 
10
+++++++++-

2 files changed, 19 insertions(+), 2 deletions(-)
diff --git a/nixos/worker-1/configuration.nix b/nixos/worker-1/configuration.nix
@@ -289,7 +289,14 @@ in {
       ];
     in {
       checkReversePath = "loose";
-      trustedInterfaces = ["lxc*" "cilium*" "floating1" "enp7s0" "gre_nordgedanken" "gre_worker2"];
+      trustedInterfaces = [
+        "lxc*"
+        "cilium*"
+        "floating1"
+        "enp7s0"
+        #"gre_nordgedanken"
+        "gre_worker2"
+      ];
       enable = true;
       allowPing = true;
       allowedTCPPorts = [
@@ -330,6 +337,7 @@ in {
         + builtins.concatStringsSep "\n" (builtins.map (ip: "ip6tables -A INPUT -s ${ip} -j DROP") blockedV6)
         + "\n"
         + ''
+          iptables -A nixos-fw -p 47 -i enp7s0 -j nixos-fw-accept
           iptables -A nixos-fw -p tcp --source 10.245.0.0/16 -j nixos-fw-accept
           ip6tables -A nixos-fw -p tcp --source fd00::/104 -j nixos-fw-accept
         '';
@@ -340,6 +348,7 @@ in {
         + builtins.concatStringsSep "\n" (builtins.map (ip: "ip6tables -D INPUT -s ${ip} -j DROP") blockedV6)
         + "\n"
         + ''
+          iptables -D nixos-fw -p 47 -i enp7s0 -j nixos-fw-accept
           iptables -D nixos-fw -p tcp --source 10.245.0.0/16 -j nixos-fw-accept
           ip6tables -D nixos-fw -p tcp --source fd00::/104 -j nixos-fw-accept
         '';
diff --git a/nixos/worker-2/configuration.nix b/nixos/worker-2/configuration.nix
@@ -268,7 +268,13 @@ in {
       ];
     in {
       checkReversePath = "loose";
-      trustedInterfaces = ["lxc*" "cilium*" "enp7s0" "gre_worker1" "gre_nordgedanken"];
+      trustedInterfaces = [
+        "lxc*"
+        "cilium*"
+        "enp7s0"
+        "gre_worker1"
+        #"gre_nordgedanken"
+      ];
       enable = true;
       allowPing = true;
       allowedTCPPorts = [
@@ -298,6 +304,7 @@ in {
         + builtins.concatStringsSep "\n" (builtins.map (ip: "ip6tables -A INPUT -s ${ip} -j DROP") blockedV6)
         + "\n"
         + ''
+          iptables -A nixos-fw -p 47 -i enp7s0 -j nixos-fw-accept
           iptables -A nixos-fw -p tcp --source 10.245.0.0/16 -j nixos-fw-accept
           ip6tables -A nixos-fw -p tcp --source fd00::/104 -j nixos-fw-accept
         '';
@@ -308,6 +315,7 @@ in {
         + builtins.concatStringsSep "\n" (builtins.map (ip: "ip6tables -D INPUT -s ${ip} -j DROP") blockedV6)
         + "\n"
         + ''
+          iptables -D nixos-fw -p 47 -i enp7s0 -j nixos-fw-accept
           iptables -D nixos-fw -p tcp --source 10.245.0.0/16 -j nixos-fw-accept
           ip6tables -D nixos-fw -p tcp --source fd00::/104 -j nixos-fw-accept
         '';