dev/nixfiles
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

nixos: Improve inner firewalls

Browse Source
This commit is contained in:
Jack O'Sullivan 2022-06-12 17:33:33 +01:00
parent c0ca7888aa
commit f38c5872a4
2 changed files with 18 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
nixos/boxes/colony/default.nix
View File

@ -155,7 +155,15 @@
server.enable = true;
firewall = {
trustedInterfaces = [ "base" "vms" ];
trustedInterfaces = [ "vms" ];
extraRules = ''
table inet filter {
chain forward {
# Trust that the outer firewall has done the filtering!
iifname base oifname vms accept
}
}
'';
};
};
};

10
nixos/boxes/colony/vms/shill/default.nix
View File

@ -117,7 +117,15 @@
firewall = {
tcp.allowed = [ 19999 ];
trustedInterfaces = [ "vms" "ctrs" ];
trustedInterfaces = [ "ctrs" ];
extraRules = ''
table inet filter {
chain forward {
# Trust that the outer firewall has done the filtering!
iifname vms oifname ctrs accept
}
}
'';
};
containers.instances =