This repository has no description
1.9 kB
30 lines
1{ lib, ... }:
2
3{
4 krebs.iptables.tables.filter.FORWARD.rules = [
5 # { v6 = false; predicate = "-d 10.233.2.0/24 -o ve-+ -m conntrack --ctstate RELATED,ESTABLISHED"; target = "ACCEPT"; }
6 # { v6 = false; predicate = "-s 10.233.2.0/24 -i ve-+"; target = "ACCEPT"; }
7 { v6 = false; predicate = "-o ctr+ -m conntrack --ctstate RELATED,ESTABLISHED"; target = "ACCEPT"; }
8 { v6 = false; predicate = "-i ctr+"; target = "ACCEPT"; }
9 { v6 = false; predicate = "-o ve-+ -m conntrack --ctstate RELATED,ESTABLISHED"; target = "ACCEPT"; }
10 { v6 = false; predicate = "-i ve-+"; target = "ACCEPT"; }
11 # { v6 = false; predicate = "-i ve-+ -o ve-+"; target = "ACCEPT"; }
12 # { v6 = false; predicate = "-o ve-+"; target = "REJECT --reject-with icmp-port-unreachable"; }
13 # { v6 = false; predicate = "-i ve-+"; target = "REJECT --reject-with icmp-port-unreachable"; }
14 ];
15 krebs.iptables.tables.nat.PREROUTING.rules = lib.mkBefore [
16 { v6 = false; predicate = "-i ctr+"; target = "ACCEPT"; }
17 { v6 = false; predicate = "-i ve-+"; target = "ACCEPT"; }
18 ];
19 krebs.iptables.tables.nat.POSTROUTING.rules = [
20 # { v6 = false; predicate = "-o et0"; target = "MASQUERADE"; }
21
22 { v6 = false; predicate = "-s 10.233.0.0/16 ! -d 10.233.0.0/16"; target = "MASQUERADE"; }
23 # { v6 = false; predicate = "-s 10.233.2.0/24 -d 224.0.0.0/24"; target = "RETURN"; }
24 # { v6 = false; predicate = "-s 10.233.2.0/24 -d 255.255.255.255"; target = "RETURN"; }
25 # { v6 = false; predicate = "-s 10.233.2.0/24 ! -d 10.233.2.0/24"; target = "MASQUERADE"; }
26 # { v6 = false; predicate = "-s 10.233.2.0/24 ! -d 10.233.2.0/24 -p tcp"; target = "MASQUERADE --to-ports 1024-65535"; }
27 # { v6 = false; predicate = "-s 10.233.2.0/24 ! -d 10.233.2.0/24 -p udp"; target = "MASQUERADE --to-ports 1024-65535"; }
28 ];
29 boot.kernel.sysctl."net.ipv4.ip_forward" = lib.mkDefault 1;
30}