tixie/nixcfg
1
0
Fork 0
forked from Deuxfleurs/nixcfg
Code Pull requests Activity

Configure firewall to allow messages from router for IGD

Browse source
This commit is contained in:
Alex 2021-12-25 19:06:19 +01:00
parent 860f69adb6
commit e77254e97f
No known key found for this signature in database
GPG key ID: EDABF9711E244EB1
2 changed files with 21 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

30
configuration.nix
View file

@ -254,6 +254,7 @@ in
config = [ config = [
{ {
volumes.enabled = true; volumes.enabled = true;
allow_privileged = true;
} }
]; ];
} }
@ -266,36 +267,45 @@ in
networking.firewall = { networking.firewall = {
allowedTCPPorts = [ allowedTCPPorts = [
(builtins.head ({ openssh.ports = [22]; } // node_config.services).openssh.ports) (builtins.head ({ openssh.ports = [22]; } // node_config.services).openssh.ports)
#3990 3991 3992 # Garage
#4646 4647 4648 # Nomad
#8500 8300 8301 8302 # Consul
#19999 # Netdata
]; ];
allowedUDPPorts = [ allowedUDPPorts = [
#4648 # Nomad
#8301 8302 # Consul
node_config.networking.wireguard.interfaces.wg0.listenPort node_config.networking.wireguard.interfaces.wg0.listenPort
]; ];
# Authorize nodes also on the Wireguard VPN to access services running here
extraCommands = '' extraCommands = ''
# Allow everything from router (usefull for UPnP/IGD)
iptables -A INPUT -s 192.168.1.254 -j ACCEPT
iptables -N VPN iptables -N VPN
iptables -A INPUT -s 10.42.0.0/16 -j VPN iptables -A INPUT -s 10.42.0.0/16 -j VPN
iptables -A VPN -p tcp --dport 3990 -j ACCEPT
iptables -A VPN -p tcp --dport 3991 -j ACCEPT # Nomad
iptables -A VPN -p tcp --dport 3992 -j ACCEPT
iptables -A VPN -p tcp --dport 4646 -j ACCEPT iptables -A VPN -p tcp --dport 4646 -j ACCEPT
iptables -A VPN -p tcp --dport 4647 -j ACCEPT iptables -A VPN -p tcp --dport 4647 -j ACCEPT
iptables -A VPN -p tcp --dport 4648 -j ACCEPT iptables -A VPN -p tcp --dport 4648 -j ACCEPT
iptables -A VPN -p udp --dport 4648 -j ACCEPT iptables -A VPN -p udp --dport 4648 -j ACCEPT
# Consul
iptables -A VPN -p tcp --dport 8500 -j ACCEPT iptables -A VPN -p tcp --dport 8500 -j ACCEPT
iptables -A VPN -p tcp --dport 8300 -j ACCEPT iptables -A VPN -p tcp --dport 8300 -j ACCEPT
iptables -A VPN -p tcp --dport 8301 -j ACCEPT iptables -A VPN -p tcp --dport 8301 -j ACCEPT
iptables -A VPN -p tcp --dport 8302 -j ACCEPT iptables -A VPN -p tcp --dport 8302 -j ACCEPT
iptables -A VPN -p udp --dport 8301 -j ACCEPT iptables -A VPN -p udp --dport 8301 -j ACCEPT
iptables -A VPN -p udp --dport 8302 -j ACCEPT iptables -A VPN -p udp --dport 8302 -j ACCEPT
# Garage
iptables -A VPN -p tcp --dport 3990 -j ACCEPT
iptables -A VPN -p tcp --dport 3991 -j ACCEPT
iptables -A VPN -p tcp --dport 3992 -j ACCEPT
# Netdata monitoring
iptables -A VPN -p tcp --dport 19999 -j ACCEPT iptables -A VPN -p tcp --dport 19999 -j ACCEPT
''; '';
#flush the chain then remove it
# When stopping firewall, delete filtering VPN chain
extraStopCommands = '' extraStopCommands = ''
iptables -D INPUT -s 192.168.1.254 -j ACCEPT
iptables -D INPUT -s 10.42.0.0/16 -j VPN iptables -D INPUT -s 10.42.0.0/16 -j VPN
iptables -F VPN iptables -F VPN
iptables -X VPN iptables -X VPN

1
site/neptune.nix
View file

@ -8,6 +8,7 @@
services.nomad.settings.datacenter = "neptune"; services.nomad.settings.datacenter = "neptune";
# Allow router to reach nodes in this site
networking.firewall.allowedTCPPorts = [ 80 443 ]; networking.firewall.allowedTCPPorts = [ 80 443 ];
# ---- # ----