forked from
lass.pds.lassul.us/superconfig
This repository has no description
configs.ssh-redirect: only reject 22 that wasn't redirected elsewhere
author
Hermes
date
(Oct 20, 2026, 10:55 AM CEST)
commit
1ff938b3
1ff938b3eed970fbbf493c0b19011f5477c8eb10
parent
5510749b
5510749bd2a4465afbfb4e6a0305805e0aa2fc7f
+3
-2
+3
-2
configs/ssh-redirect.nix
+3
-2
configs/ssh-redirect.nix
···
13
13
}
14
14
# Runs before nixos-fw, which accepts 22 everywhere. Connections that
15
15
# came in on 45621 have been redirected to 22 already, so match the
16
-
# port the client asked for.
16
+
# port the client asked for. tcp dport 22 spares connections to 22
17
+
# that got redirected elsewhere (the tangled knot on neoprism).
17
18
chain input {
18
19
type filter hook input priority filter - 1; policy accept;
19
-
ct state new meta l4proto tcp ct original proto-dst 22 iifname != { "lo", "retiolum", "wiregrill" } reject with tcp reset
20
+
ct state new tcp dport 22 ct original proto-dst 22 iifname != { "lo", "retiolum", "wiregrill" } reject with tcp reset
20
21
}
21
22
'';
22
23
};