This repository has no description
2.0 kB
58 lines
1{ lib, ... }:
2
3{
4 krebs.iptables.tables.filter.FORWARD.rules = [
5 # { v6 = false; predicate = "-d 10.233.2.0/24 -o ve-+ -m conntrack --ctstate RELATED,ESTABLISHED"; target = "ACCEPT"; }
6 # { v6 = false; predicate = "-s 10.233.2.0/24 -i ve-+"; target = "ACCEPT"; }
7 {
8 v6 = false;
9 predicate = "-o ctr+ -m conntrack --ctstate RELATED,ESTABLISHED";
10 target = "ACCEPT";
11 }
12 {
13 v6 = false;
14 predicate = "-i ctr+";
15 target = "ACCEPT";
16 }
17 {
18 v6 = false;
19 predicate = "-o ve-+ -m conntrack --ctstate RELATED,ESTABLISHED";
20 target = "ACCEPT";
21 }
22 {
23 v6 = false;
24 predicate = "-i ve-+";
25 target = "ACCEPT";
26 }
27 # { v6 = false; predicate = "-i ve-+ -o ve-+"; target = "ACCEPT"; }
28 # { v6 = false; predicate = "-o ve-+"; target = "REJECT --reject-with icmp-port-unreachable"; }
29 # { v6 = false; predicate = "-i ve-+"; target = "REJECT --reject-with icmp-port-unreachable"; }
30 ];
31 krebs.iptables.tables.nat.PREROUTING.rules = lib.mkBefore [
32 {
33 v6 = false;
34 predicate = "-i ctr+";
35 target = "ACCEPT";
36 }
37 {
38 v6 = false;
39 predicate = "-i ve-+";
40 target = "ACCEPT";
41 }
42 ];
43 krebs.iptables.tables.nat.POSTROUTING.rules = [
44 # { v6 = false; predicate = "-o et0"; target = "MASQUERADE"; }
45
46 {
47 v6 = false;
48 predicate = "-s 10.233.0.0/16 ! -d 10.233.0.0/16";
49 target = "MASQUERADE";
50 }
51 # { v6 = false; predicate = "-s 10.233.2.0/24 -d 224.0.0.0/24"; target = "RETURN"; }
52 # { v6 = false; predicate = "-s 10.233.2.0/24 -d 255.255.255.255"; target = "RETURN"; }
53 # { v6 = false; predicate = "-s 10.233.2.0/24 ! -d 10.233.2.0/24"; target = "MASQUERADE"; }
54 # { v6 = false; predicate = "-s 10.233.2.0/24 ! -d 10.233.2.0/24 -p tcp"; target = "MASQUERADE --to-ports 1024-65535"; }
55 # { v6 = false; predicate = "-s 10.233.2.0/24 ! -d 10.233.2.0/24 -p udp"; target = "MASQUERADE --to-ports 1024-65535"; }
56 ];
57 boot.kernel.sysctl."net.ipv4.ip_forward" = lib.mkDefault 1;
58}