diff options
| author | tv <tv@krebsco.de> | 2022-12-09 18:07:20 +0100 |
|---|---|---|
| committer | tv <tv@krebsco.de> | 2022-12-09 18:07:26 +0100 |
| commit | b17cd6133b92b9f936ee83f86bb8ff8f54e9565d (patch) | |
| tree | fade550896b35762d051a85687c987dea6f6a98e | |
| parent | ea30ea8661dbc83f8d2f96f2c511aa04992d3ffe (diff) | |
ponte: modify internet-facing SSH port
| -rw-r--r-- | krebs/1systems/ponte/config.nix | 15 |
1 files changed, 15 insertions, 0 deletions
diff --git a/krebs/1systems/ponte/config.nix b/krebs/1systems/ponte/config.nix index f896c507..2f55995c 100644 --- a/krebs/1systems/ponte/config.nix +++ b/krebs/1systems/ponte/config.nix @@ -11,6 +11,21 @@ networking.firewall.logRefusedConnections = false; networking.firewall.logRefusedUnicastsOnly = false; + # Move Internet-facing SSH port to reduce logspam. + networking.firewall.extraCommands = let + host = config.krebs.build.host; + in /* sh */ '' + iptables -t nat -A OUTPUT -o lo -p tcp --dport 11423 -j REDIRECT --to-ports 22 + iptables -t nat -A PREROUTING -p tcp --dport 11423 -j REDIRECT --to-ports 22 + iptables -t nat -A PREROUTING -d ${host.nets.retiolum.ip4.addr} -p tcp --dport 22 -j ACCEPT + iptables -t nat -A PREROUTING -p tcp --dport 22 -j REDIRECT --to-ports 0 + + ip6tables -t nat -A OUTPUT -o lo -p tcp --dport 11423 -j REDIRECT --to-ports 22 + ip6tables -t nat -A PREROUTING -p tcp --dport 11423 -j REDIRECT --to-ports 22 + ip6tables -t nat -A PREROUTING -d ${host.nets.retiolum.ip6.addr} -p tcp --dport 22 -j ACCEPT + ip6tables -t nat -A PREROUTING -p tcp --dport 22 -j REDIRECT --to-ports 0 + ''; + krebs.build.host = config.krebs.hosts.ponte; krebs.pages.enable = true; |