summaryrefslogtreecommitdiffstats
path: root/krebs/1systems/ponte/config.nix
diff options
context:
space:
mode:
authortv <tv@krebsco.de>2022-12-09 18:07:20 +0100
committertv <tv@krebsco.de>2022-12-09 18:07:26 +0100
commitb17cd6133b92b9f936ee83f86bb8ff8f54e9565d (patch)
treefade550896b35762d051a85687c987dea6f6a98e /krebs/1systems/ponte/config.nix
parentea30ea8661dbc83f8d2f96f2c511aa04992d3ffe (diff)
ponte: modify internet-facing SSH port
Diffstat (limited to 'krebs/1systems/ponte/config.nix')
-rw-r--r--krebs/1systems/ponte/config.nix15
1 files changed, 15 insertions, 0 deletions
diff --git a/krebs/1systems/ponte/config.nix b/krebs/1systems/ponte/config.nix
index f896c507b..2f55995cf 100644
--- a/krebs/1systems/ponte/config.nix
+++ b/krebs/1systems/ponte/config.nix
@@ -11,6 +11,21 @@
networking.firewall.logRefusedConnections = false;
networking.firewall.logRefusedUnicastsOnly = false;
+ # Move Internet-facing SSH port to reduce logspam.
+ networking.firewall.extraCommands = let
+ host = config.krebs.build.host;
+ in /* sh */ ''
+ iptables -t nat -A OUTPUT -o lo -p tcp --dport 11423 -j REDIRECT --to-ports 22
+ iptables -t nat -A PREROUTING -p tcp --dport 11423 -j REDIRECT --to-ports 22
+ iptables -t nat -A PREROUTING -d ${host.nets.retiolum.ip4.addr} -p tcp --dport 22 -j ACCEPT
+ iptables -t nat -A PREROUTING -p tcp --dport 22 -j REDIRECT --to-ports 0
+
+ ip6tables -t nat -A OUTPUT -o lo -p tcp --dport 11423 -j REDIRECT --to-ports 22
+ ip6tables -t nat -A PREROUTING -p tcp --dport 11423 -j REDIRECT --to-ports 22
+ ip6tables -t nat -A PREROUTING -d ${host.nets.retiolum.ip6.addr} -p tcp --dport 22 -j ACCEPT
+ ip6tables -t nat -A PREROUTING -p tcp --dport 22 -j REDIRECT --to-ports 0
+ '';
+
krebs.build.host = config.krebs.hosts.ponte;
krebs.pages.enable = true;