diff options
| author | Alex Auvolat <alex@adnab.me> | 2021-12-25 19:06:19 +0100 |
|---|---|---|
| committer | Alex Auvolat <alex@adnab.me> | 2021-12-25 19:06:19 +0100 |
| commit | e77254e97f16dfec41277e46ba3ddc7e2bd3d664 (patch) | |
| tree | f026417589908f15b69b211dd82ed1741e62fbbd | |
| parent | 860f69adb6ef4b277c750b6d57c7693870f57592 (diff) | |
| download | nixcfg-e77254e97f16dfec41277e46ba3ddc7e2bd3d664.tar.gz nixcfg-e77254e97f16dfec41277e46ba3ddc7e2bd3d664.zip | |
Configure firewall to allow messages from router for IGD
| -rw-r--r-- | configuration.nix | 30 | ||||
| -rw-r--r-- | site/neptune.nix | 1 |
2 files changed, 21 insertions, 10 deletions
diff --git a/configuration.nix b/configuration.nix index 124af9a..89b9c2d 100644 --- a/configuration.nix +++ b/configuration.nix @@ -254,6 +254,7 @@ in config = [ { volumes.enabled = true; + allow_privileged = true; } ]; } @@ -266,36 +267,45 @@ in networking.firewall = { allowedTCPPorts = [ (builtins.head ({ openssh.ports = [22]; } // node_config.services).openssh.ports) - #3990 3991 3992 # Garage - #4646 4647 4648 # Nomad - #8500 8300 8301 8302 # Consul - #19999 # Netdata ]; allowedUDPPorts = [ - #4648 # Nomad - #8301 8302 # Consul node_config.networking.wireguard.interfaces.wg0.listenPort ]; + + # Authorize nodes also on the Wireguard VPN to access services running here extraCommands = '' + # Allow everything from router (usefull for UPnP/IGD) + iptables -A INPUT -s 192.168.1.254 -j ACCEPT + iptables -N VPN iptables -A INPUT -s 10.42.0.0/16 -j VPN - iptables -A VPN -p tcp --dport 3990 -j ACCEPT - iptables -A VPN -p tcp --dport 3991 -j ACCEPT - iptables -A VPN -p tcp --dport 3992 -j ACCEPT + + # Nomad iptables -A VPN -p tcp --dport 4646 -j ACCEPT iptables -A VPN -p tcp --dport 4647 -j ACCEPT iptables -A VPN -p tcp --dport 4648 -j ACCEPT iptables -A VPN -p udp --dport 4648 -j ACCEPT + + # Consul iptables -A VPN -p tcp --dport 8500 -j ACCEPT iptables -A VPN -p tcp --dport 8300 -j ACCEPT iptables -A VPN -p tcp --dport 8301 -j ACCEPT iptables -A VPN -p tcp --dport 8302 -j ACCEPT iptables -A VPN -p udp --dport 8301 -j ACCEPT iptables -A VPN -p udp --dport 8302 -j ACCEPT + + # Garage + iptables -A VPN -p tcp --dport 3990 -j ACCEPT + iptables -A VPN -p tcp --dport 3991 -j ACCEPT + iptables -A VPN -p tcp --dport 3992 -j ACCEPT + + # Netdata monitoring iptables -A VPN -p tcp --dport 19999 -j ACCEPT ''; - #flush the chain then remove it + + # When stopping firewall, delete filtering VPN chain extraStopCommands = '' + iptables -D INPUT -s 192.168.1.254 -j ACCEPT iptables -D INPUT -s 10.42.0.0/16 -j VPN iptables -F VPN iptables -X VPN diff --git a/site/neptune.nix b/site/neptune.nix index 13e0e21..f640fc1 100644 --- a/site/neptune.nix +++ b/site/neptune.nix @@ -8,6 +8,7 @@ services.nomad.settings.datacenter = "neptune"; + # Allow router to reach nodes in this site networking.firewall.allowedTCPPorts = [ 80 443 ]; # ---- |