aboutsummaryrefslogtreecommitdiff
path: root/configuration.nix
diff options
context:
space:
mode:
Diffstat (limited to 'configuration.nix')
-rw-r--r--configuration.nix40
1 files changed, 6 insertions, 34 deletions
diff --git a/configuration.nix b/configuration.nix
index c493496..ca403ec 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -309,46 +309,18 @@ in
# Allow everything from router (usefull for UPnP/IGD)
iptables -A INPUT -s 192.168.1.254 -j ACCEPT
- # Allow Docker containers to access a few things
- iptables -N CONTAINERS
- iptables -A INPUT -s 172.17.0.0/16 -j CONTAINERS
+ # Allow docker containers to access all ports
+ iptables -A INPUT -s 172.17.0.0/16 -j ACCEPT
- # Yugabyte YSQL
- iptables -A CONTAINERS -p tcp --dport 5433 -j ACCEPT
-
- # Specific rules for VPN nodes
- iptables -N VPN
- iptables -A INPUT -s 10.42.0.0/16 -j VPN
-
- # Allow server nodes to communicate between themselves on all ports
- iptables -A VPN -s 10.42.0.2 -j ACCEPT
- iptables -A VPN -s 10.42.0.21 -j ACCEPT
- iptables -A VPN -s 10.42.0.22 -j ACCEPT
- iptables -A VPN -s 10.42.0.23 -j ACCEPT
-
- # Allow all VPN users to access Nomad API
- iptables -A VPN -p tcp --dport 4646 -j ACCEPT
-
- # Same for Consul API
- iptables -A VPN -p tcp --dport 8500 -j ACCEPT
-
- # Same for YugabyteDB YSQL and Admin ports
- iptables -A VPN -p tcp --dport 5433 -j ACCEPT
- iptables -A VPN -p tcp --dport 7000 -j ACCEPT
-
- # Same for Netdata monitoring
- iptables -A VPN -p tcp --dport 19999 -j ACCEPT
+ # Allow other nodes on VPN to access all ports
+ iptables -A INPUT -s 10.42.0.0/16 -j ACCEPT
'';
# When stopping firewall, delete all rules that were configured manually above
extraStopCommands = ''
iptables -D INPUT -s 192.168.1.254 -j ACCEPT
- iptables -D INPUT -s 10.42.0.0/16 -j VPN
- iptables -F VPN
- iptables -X VPN
- iptables -D INPUT -s 172.17.0.0/16 -j CONTAINERS
- iptables -F CONTAINERS
- iptables -X CONTAINERS
+ iptables -D INPUT -s 172.17.0.0/16 -j ACCEPT
+ iptables -D INPUT -s 10.42.0.0/16 -j ACCEPT
'';
};