cst1/infrastructure
1
0
Fork 0
forked from DGNum/infrastructure
Code Pull requests Activity

fix(routing): clean icmp storm

Browse source
This commit is contained in:
catvayor 2024-05-31 20:29:53 +02:00
parent dce439fcca
commit 411795c664
Signed by untrusted user: lbailly
GPG key ID: CE3E645251AC63F3
2 changed files with 16 additions and 14 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
machines/vault01/networking.nix
View file

@ -116,7 +116,16 @@ let
vlan-admin-ap = { vlan-admin-ap = {
Id = 3001; Id = 3001;
address = [ "fd26:baf9:d250:8010::1/60" ]; address = [ "fd26:baf9:d250:8001::1/64" ];
extraNetwork.ipv6Prefixes = [
{
ipv6PrefixConfig = {
AddressAutoconfiguration = false;
OnLink = false;
Prefix = "fd26:baf9:d250:8001::/64";
};
}
];
}; };
vlan-apro = { vlan-apro = {
@ -229,12 +238,15 @@ in
content = '' content = ''
chain postrouting { chain postrouting {
type nat hook postrouting priority 100; type nat hook postrouting priority 100;
snat ip to 129.199.195.130-129.199.195.158 ip saddr 10.0.0.0/16 snat ip to 129.199.195.130-129.199.195.158
} }
''; '';
}; };
}; };
firewall.allowedUDPPorts = [ 67 ]; firewall = {
allowedUDPPorts = [ 67 ];
checkReversePath = false;
};
}; };
boot.kernel.sysctl."net.ipv4.ip_forward" = true; boot.kernel.sysctl."net.ipv4.ip_forward" = true;

12
meta/network.nix
View file

@ -98,17 +98,7 @@
{ {
# see also machines/vault01/networking.nix # see also machines/vault01/networking.nix
address = "129.199.195.129"; address = "129.199.195.129";
prefixLength = 27; prefixLength = 32;
}
];
gateways = [ ];
enableDefaultDNS = true;
};
enp130s0f0 = {
ipv4 = [
{
address = "192.168.42.7";
prefixLength = 24;
} }
]; ];
gateways = [ ]; gateways = [ ];