HackENS/liminix-fork
6
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

rotuer: use firewallgen to make packet filter rules

Browse source
This commit is contained in:
Daniel Barlow 2023-06-20 20:20:32 +01:00
parent d79a1e15bb
commit b002a94e07
2 changed files with 133 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

10
examples/rotuer.nix
View file

@ -226,15 +226,23 @@ in rec {
dependencies = [ services.wan ];
};
services.firewall =
let config = pkgs.firewallgen "firewall.nft" (import ./rotuer-firewall.nix);
in oneshot {
name = "firewall";
up = config;
down = "${pkgs.nftables}/bin/nft flush ruleset";
};
services.packet_forwarding =
let filename = "/proc/sys/net/ipv4/conf/all/forwarding";
in oneshot {
name = "let-the-ip-flow";
up = ''
${pkgs.nftables}/bin/nft -f ${../nat.nft}
echo 1 > ${filename}
'';
down = "echo 0 > ${filename}";
dependencies = [ services.firewall ];
};
services.dhcp6 =