From b034f63f7a2e4361b32c33c0e1a980eecf1a5aa6 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sat, 17 Oct 2020 01:00:54 +0200
Subject: tv iptables: move sshd stuff to sshd config

---
 tv/2configs/sshd.nix | 20 ++++++++++++++++----
 1 file changed, 16 insertions(+), 4 deletions(-)

(limited to 'tv/2configs')

diff --git a/tv/2configs/sshd.nix b/tv/2configs/sshd.nix
index 25468f23..79af5b01 100644
--- a/tv/2configs/sshd.nix
+++ b/tv/2configs/sshd.nix
@@ -1,10 +1,22 @@
-{ config, lib, pkgs, ... }:
-
 with import <stockholm/lib>;
-
-{
+{ config, ... }: let
+  cfg.host = config.krebs.build.host;
+in {
   services.openssh = {
     enable = true;
   };
   tv.iptables.input-internet-accept-tcp = singleton "ssh";
+  tv.iptables.extra.nat.OUTPUT = [
+    "-o lo -p tcp --dport 11423 -j REDIRECT --to-ports 22"
+  ];
+  tv.iptables.extra4.nat.PREROUTING = [
+    "-d ${cfg.host.nets.retiolum.ip4.addr} -p tcp --dport 22 -j ACCEPT"
+  ];
+  tv.iptables.extra6.nat.PREROUTING = [
+    "-d ${cfg.host.nets.retiolum.ip6.addr} -p tcp --dport 22 -j ACCEPT"
+  ];
+  tv.iptables.extra.nat.PREROUTING = [
+    "-p tcp --dport 22 -j REDIRECT --to-ports 0"
+    "-p tcp --dport 11423 -j REDIRECT --to-ports 22"
+  ];
 }
-- 
cgit v1.2.3