dev/nixfiles
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

nixos/firewall: DNAT by IP instead of incoming interface

Browse Source
This commit is contained in:
Jack O'Sullivan 2023-04-21 15:44:30 +01:00
parent 4d8935ffd6
commit d427de57fe
2 changed files with 6 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
nixos/boxes/colony/vms/estuary/default.nix
View File

@ -324,6 +324,7 @@ in
nat = { nat = {
enable = true; enable = true;
externalInterface = "wan"; externalInterface = "wan";
externalIP = assignments.internal.ipv4.address;
forwardPorts = [ forwardPorts = [
{ {
port = "http"; port = "http";

10
nixos/modules/firewall.nix
View File

@ -62,7 +62,7 @@ in
nat = with options.networking.nat; { nat = with options.networking.nat; {
enable = mkBoolOpt' true "Whether to enable IP forwarding and NAT."; enable = mkBoolOpt' true "Whether to enable IP forwarding and NAT.";
inherit externalInterface; inherit externalInterface externalIP;
forwardPorts = mkOpt' (listOf (submodule forwardOpts)) [ ] "List of port forwards."; forwardPorts = mkOpt' (listOf (submodule forwardOpts)) [ ] "List of port forwards.";
}; };
}; };
@ -143,8 +143,8 @@ in
(mkIf cfg.nat.enable { (mkIf cfg.nat.enable {
assertions = [ assertions = [
{ {
assertion = (cfg.nat.forwardPorts != [ ]) -> (cfg.nat.externalInterface != null); assertion = with cfg.nat; (forwardPorts != [ ]) -> (externalInterface != null && externalIP != null);
message = "my.firewall.nat.forwardPorts requires my.firewall.nat.externalInterface"; message = "my.firewall.nat.forwardPorts requires my.firewall.nat.external{Interface,IP}";
} }
]; ];
@ -198,8 +198,8 @@ in
} }
chain prerouting { chain prerouting {
${optionalString ${optionalString
(cfg.nat.externalInterface != null) (cfg.nat.externalIP != null)
"iifname ${cfg.nat.externalInterface} jump port-forward"} "ip daddr ${cfg.nat.externalIP} jump port-forward"}
} }
} }
''; '';