This repository has no description
868 B
23 lines
1# Public ssh is on 45621; port 22 itself only answers on the VPNs (and lo).
2{
3 networking.nftables.tables.ssh-redirect = {
4 family = "inet";
5 content = ''
6 chain prerouting {
7 type nat hook prerouting priority dstnat; policy accept;
8 tcp dport 45621 redirect to :22
9 }
10 chain output {
11 type nat hook output priority dstnat; policy accept;
12 oifname "lo" tcp dport 45621 redirect to :22
13 }
14 # Runs before nixos-fw, which accepts 22 everywhere. Connections that
15 # came in on 45621 have been redirected to 22 already, so match the
16 # port the client asked for.
17 chain input {
18 type filter hook input priority filter - 1; policy accept;
19 ct state new meta l4proto tcp ct original proto-dst 22 iifname != { "lo", "retiolum", "wiregrill" } reject with tcp reset
20 }
21 '';
22 };
23}