From e2ff8598a61a7ebd99e87de888f0d12d096c0b12 Mon Sep 17 00:00:00 2001 From: lassulus Date: Wed, 28 Dec 2022 20:39:23 +0100 Subject: l wiregrill: use networkd --- lass/2configs/wiregrill.nix | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'lass/2configs/wiregrill.nix') diff --git a/lass/2configs/wiregrill.nix b/lass/2configs/wiregrill.nix index 54257d2c..ba6358ab 100644 --- a/lass/2configs/wiregrill.nix +++ b/lass/2configs/wiregrill.nix @@ -23,6 +23,13 @@ in mkIf (hasAttr "wiregrill" config.krebs.build.host.nets) { { precedence = 1000; predicate = "-i wiregrill -o eth0"; target = "ACCEPT"; } { precedence = 1000; predicate = "-o wiregrill -m conntrack --ctstate RELATED,ESTABLISHED"; target = "ACCEPT"; } ]; + systemd.network.networks.wiregrill = { + matchConfig.Name = "wiregrill"; + address = + (optional (!isNull self.ip4) "${self.ip4.addr}/16") ++ + (optional (!isNull self.ip6) "${self.ip6.addr}/48") + ; + }; networking.wireguard.interfaces.wiregrill = { ips = -- cgit v1.2.3 From 2ebbec1f2d9c16fe084abba87718d0f60e61bf88 Mon Sep 17 00:00:00 2001 From: tv Date: Fri, 30 Dec 2022 21:34:05 +0100 Subject: krebs.iptables: precedence -> mkOrder --- lass/2configs/wiregrill.nix | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) (limited to 'lass/2configs/wiregrill.nix') diff --git a/lass/2configs/wiregrill.nix b/lass/2configs/wiregrill.nix index ba6358ab..a27e99ee 100644 --- a/lass/2configs/wiregrill.nix +++ b/lass/2configs/wiregrill.nix @@ -16,13 +16,13 @@ in mkIf (hasAttr "wiregrill" config.krebs.build.host.nets) { krebs.iptables.tables.filter.INPUT.rules = [ { predicate = "-p udp --dport ${toString self.wireguard.port}"; target = "ACCEPT"; } ]; - krebs.iptables.tables.filter.FORWARD.rules = mkIf isRouter [ - { precedence = 1000; predicate = "-i wiregrill -o wiregrill"; target = "ACCEPT"; } - { precedence = 1000; predicate = "-i wiregrill -o retiolum"; target = "ACCEPT"; } - { precedence = 1000; predicate = "-i retiolum -o wiregrill"; target = "ACCEPT"; } - { precedence = 1000; predicate = "-i wiregrill -o eth0"; target = "ACCEPT"; } - { precedence = 1000; predicate = "-o wiregrill -m conntrack --ctstate RELATED,ESTABLISHED"; target = "ACCEPT"; } - ]; + krebs.iptables.tables.filter.FORWARD.rules = mkIf isRouter (mkBefore [ + { predicate = "-i wiregrill -o wiregrill"; target = "ACCEPT"; } + { predicate = "-i wiregrill -o retiolum"; target = "ACCEPT"; } + { predicate = "-i retiolum -o wiregrill"; target = "ACCEPT"; } + { predicate = "-i wiregrill -o eth0"; target = "ACCEPT"; } + { predicate = "-o wiregrill -m conntrack --ctstate RELATED,ESTABLISHED"; target = "ACCEPT"; } + ]); systemd.network.networks.wiregrill = { matchConfig.Name = "wiregrill"; address = -- cgit v1.2.3