Don't blindly trust as211024

2023-12-20 22:59:51 +00:00
parent 0fe863844f
commit e760569b3e
4 changed files with 32 additions and 5 deletions
--- a/nixos/boxes/colony/vms/estuary/default.nix
+++ b/nixos/boxes/colony/vms/estuary/default.nix
@@ -366,7 +366,6 @@ in
                };
              };
              firewall = {
-                trustedInterfaces = [ "as211024" ];
                udp.allowed = [ 5353 lib.my.c.kelder.vpn.port ];
                tcp.allowed = [ 5353 "bgp" ];
                nat = {
@@ -416,7 +415,8 @@ in
                    }

                    chain forward {
-                      iifname { wan, $ixps } oifname base jump filter-routing
+                      ${lib.my.c.as211024.nftTrust}
+                      iifname { wan, as211024, $ixps } oifname base jump filter-routing
                      oifname $ixps jump ixp
                      iifname base oifname { base, wan, $ixps } accept
                      oifname { as211024, kelder } accept