aboutsummaryrefslogtreecommitdiff
path: root/configuration.nix
diff options
context:
space:
mode:
authorAlex Auvolat <alex@adnab.me>2021-12-25 19:06:19 +0100
committerAlex Auvolat <alex@adnab.me>2021-12-25 19:06:19 +0100
commite77254e97f16dfec41277e46ba3ddc7e2bd3d664 (patch)
treef026417589908f15b69b211dd82ed1741e62fbbd /configuration.nix
parent860f69adb6ef4b277c750b6d57c7693870f57592 (diff)
downloadnixcfg-e77254e97f16dfec41277e46ba3ddc7e2bd3d664.tar.gz
nixcfg-e77254e97f16dfec41277e46ba3ddc7e2bd3d664.zip
Configure firewall to allow messages from router for IGD
Diffstat (limited to 'configuration.nix')
-rw-r--r--configuration.nix30
1 files changed, 20 insertions, 10 deletions
diff --git a/configuration.nix b/configuration.nix
index 124af9a..89b9c2d 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -254,6 +254,7 @@ in
config = [
{
volumes.enabled = true;
+ allow_privileged = true;
}
];
}
@@ -266,36 +267,45 @@ in
networking.firewall = {
allowedTCPPorts = [
(builtins.head ({ openssh.ports = [22]; } // node_config.services).openssh.ports)
- #3990 3991 3992 # Garage
- #4646 4647 4648 # Nomad
- #8500 8300 8301 8302 # Consul
- #19999 # Netdata
];
allowedUDPPorts = [
- #4648 # Nomad
- #8301 8302 # Consul
node_config.networking.wireguard.interfaces.wg0.listenPort
];
+
+ # Authorize nodes also on the Wireguard VPN to access services running here
extraCommands = ''
+ # Allow everything from router (usefull for UPnP/IGD)
+ iptables -A INPUT -s 192.168.1.254 -j ACCEPT
+
iptables -N VPN
iptables -A INPUT -s 10.42.0.0/16 -j VPN
- iptables -A VPN -p tcp --dport 3990 -j ACCEPT
- iptables -A VPN -p tcp --dport 3991 -j ACCEPT
- iptables -A VPN -p tcp --dport 3992 -j ACCEPT
+
+ # Nomad
iptables -A VPN -p tcp --dport 4646 -j ACCEPT
iptables -A VPN -p tcp --dport 4647 -j ACCEPT
iptables -A VPN -p tcp --dport 4648 -j ACCEPT
iptables -A VPN -p udp --dport 4648 -j ACCEPT
+
+ # Consul
iptables -A VPN -p tcp --dport 8500 -j ACCEPT
iptables -A VPN -p tcp --dport 8300 -j ACCEPT
iptables -A VPN -p tcp --dport 8301 -j ACCEPT
iptables -A VPN -p tcp --dport 8302 -j ACCEPT
iptables -A VPN -p udp --dport 8301 -j ACCEPT
iptables -A VPN -p udp --dport 8302 -j ACCEPT
+
+ # Garage
+ iptables -A VPN -p tcp --dport 3990 -j ACCEPT
+ iptables -A VPN -p tcp --dport 3991 -j ACCEPT
+ iptables -A VPN -p tcp --dport 3992 -j ACCEPT
+
+ # Netdata monitoring
iptables -A VPN -p tcp --dport 19999 -j ACCEPT
'';
- #flush the chain then remove it
+
+ # When stopping firewall, delete filtering VPN chain
extraStopCommands = ''
+ iptables -D INPUT -s 192.168.1.254 -j ACCEPT
iptables -D INPUT -s 10.42.0.0/16 -j VPN
iptables -F VPN
iptables -X VPN