diff options
| author | tv <tv@krebsco.de> | 2023-09-11 14:55:04 +0200 |
|---|---|---|
| committer | tv <tv@krebsco.de> | 2023-09-11 14:55:04 +0200 |
| commit | 8fc162ee3d9525a2b45346a1ca8f34ccb5ef971b (patch) | |
| tree | aa37724dd0452860d4b9b033332587c8832629e3 /lass/2configs/libvirt.nix | |
| parent | 90b1515dcd5b67a85cd92901fb211764b1fa5f83 (diff) | |
| parent | 083229d0211096daec08673f743ccc45b1d8a0ac (diff) | |
Merge remote-tracking branch 'orange/master'
Diffstat (limited to 'lass/2configs/libvirt.nix')
| -rw-r--r-- | lass/2configs/libvirt.nix | 33 |
1 files changed, 0 insertions, 33 deletions
diff --git a/lass/2configs/libvirt.nix b/lass/2configs/libvirt.nix deleted file mode 100644 index 6d07c7a77..000000000 --- a/lass/2configs/libvirt.nix +++ /dev/null @@ -1,33 +0,0 @@ -{ config, lib, pkgs, ... }: - -{ - virtualisation.libvirtd.enable = true; - security.polkit.enable = true; - - krebs.iptables.tables.filter.INPUT.rules = [ - { v6 = false; predicate = "-i virbr0 -p udp -m udp --dport 53"; target = "ACCEPT"; } - { v6 = false; predicate = "-i virbr0 -p tcp -m tcp --dport 53"; target = "ACCEPT"; } - { v6 = false; predicate = "-i virbr0 -p udp -m udp --dport 67"; target = "ACCEPT"; } - { v6 = false; predicate = "-i virbr0 -p tcp -m tcp --dport 67"; target = "ACCEPT"; } - ]; - krebs.iptables.tables.filter.FORWARD.rules = [ - { v6 = false; predicate = "-d 192.168.122.0/24 -o virbr0 -m conntrack --ctstate RELATED,ESTABLISHED"; target = "ACCEPT"; } - { v6 = false; predicate = "-s 192.168.122.0/24 -i virbr0"; target = "ACCEPT"; } - { v6 = false; predicate = "-i virbr0 -o virbr0"; target = "ACCEPT"; } - { v6 = false; predicate = "-o virbr0"; target = "REJECT --reject-with icmp-port-unreachable"; } - { v6 = false; predicate = "-i virbr0"; target = "REJECT --reject-with icmp-port-unreachable"; } - ]; - krebs.iptables.tables.filter.OUTPUT.rules = [ - { v6 = false; predicate = "-o virbr0 -p udp -m udp --dport 68"; target = "ACCEPT"; } - ]; - krebs.iptables.tables.nat.PREROUTING.rules = lib.mkBefore [ - { v6 = false; predicate = "-s 192.168.122.0/24"; target = "ACCEPT"; } - ]; - krebs.iptables.tables.nat.POSTROUTING.rules = [ - { v6 = false; predicate = "-s 192.168.122.0/24 -d 224.0.0.0/24"; target = "RETURN"; } - { v6 = false; predicate = "-s 192.168.122.0/24 -d 255.255.255.255"; target = "RETURN"; } - { v6 = false; predicate = "-s 192.168.122.0/24 ! -d 192.168.122.0/24"; target = "MASQUERADE"; } - { v6 = false; predicate = "-s 192.168.122.0/24 ! -d 192.168.122.0/24 -p tcp"; target = "MASQUERADE --to-ports 1024-65535"; } - { v6 = false; predicate = "-s 192.168.122.0/24 ! -d 192.168.122.0/24 -p udp"; target = "MASQUERADE --to-ports 1024-65535"; } - ]; -} |