nixos

commit 260336c7cc0ad7a0dc25bd25788ca7652297b83f
parent fd115ba5019e9f84eaedb62284fb0634550c2dfd
Author: MTRNord <mtrnord1@gmail.com>
Date:   Tue, 12 Sep 2023 21:23:27 +0200

Fix k8s firewall

Diffstat:
M
nixos/worker-1/configuration.nix
 | 
13
+++++++++++--

1 file changed, 11 insertions(+), 2 deletions(-)
diff --git a/nixos/worker-1/configuration.nix b/nixos/worker-1/configuration.nix
@@ -259,11 +259,20 @@
 
         extraCommands =
           builtins.concatStringsSep "\n" (builtins.map (ip: "iptables -A INPUT -s ${ip} -j DROP") blockedV4) + "\n"
-          + builtins.concatStringsSep "\n" (builtins.map (ip: "ip6tables -A INPUT -s ${ip} -j DROP") blockedV6);
+          + builtins.concatStringsSep "\n" (builtins.map (ip: "ip6tables -A INPUT -s ${ip} -j DROP") blockedV6) + "\n"
+          + ''
+            iptables -A nixos-fw -p tcp --source 10.245.0.0/16 -j nixos-fw-accept
+            ip6tables -A nixos-fw -p tcp --source fd00::/104 -j nixos-fw-accept
+          '';
 
         extraStopCommands =
           builtins.concatStringsSep "\n" (builtins.map (ip: "iptables -D INPUT -s ${ip} -j DROP") blockedV4) + "\n"
-          + builtins.concatStringsSep "\n" (builtins.map (ip: "ip6tables -D INPUT -s ${ip} -j DROP") blockedV6);
+          + builtins.concatStringsSep "\n" (builtins.map (ip: "ip6tables -D INPUT -s ${ip} -j DROP") blockedV6) + "\n"
+          + ''
+            iptables -D nixos-fw -p tcp --source 10.245.0.0/16 -j nixos-fw-accept
+            ip6tables -D nixos-fw -p tcp --source fd00::/104 -j nixos-fw-accept
+          '';
+
       };
   };