This repository has no description
transmission: re-expose rpc port to vpn
author
Jörg Thalheim
date
(Mar 10, 2024, 8:08 AM CET)
commit
c7911ecc
c7911ecc5063bf8ec47080b9bdfb53407858bba3
parent
81ec5732
81ec57329a7c888f23230c2e9155b68b8c5471b2
+21
-1
+1
-1
2configs/default.nix
+1
-1
2configs/default.nix
···
226
226
enable = true;
227
227
tables = {
228
228
filter.INPUT.policy = "DROP";
229
-
filter.FORWARD.policy = "DROP";
229
+
filter.FORWARD.policy = lib.mkDefault "DROP";
230
230
filter.INPUT.rules = lib.mkMerge [
231
231
(lib.mkBefore [
232
232
{ predicate = "-m conntrack --ctstate RELATED,ESTABLISHED"; target = "ACCEPT"; }
+14
machines/yellow/config.nix
+14
machines/yellow/config.nix
···
17
17
18
18
networking.useHostResolvConf = false;
19
19
networking.useNetworkd = true;
20
+
# we need to set a namserver here that can be also be reached from the transmission network namespace
21
+
environment.etc."resolv.conf".text = ''
22
+
options edns0
23
+
nameserver 9.9.9.9
24
+
'';
25
+
services.resolved.enable = lib.mkForce false;
20
26
21
27
systemd.services.transmission-netns = {
22
28
wantedBy = [ "multi-user.target" ];
···
37
43
ip netns exec transmission wg syncconf airvpn <(wg-quick strip /etc/secrets/airvpn.conf)
38
44
ip -n transmission link set airvpn up
39
45
ip -n transmission route add default dev airvpn
46
+
ip -6 -n transmission route add default dev airvpn
40
47
ip link add t1 type veth peer name t2
41
48
ip link set t1 netns transmission
49
+
42
50
ip addr add 128.0.0.2/30 dev t2
51
+
ip addr add fdb4:3310:947::1/64 dev t2
43
52
ip link set t2 up
44
53
ip -n transmission addr add 128.0.0.1/30 dev t1
54
+
ip -n transmission addr add fdb4:3310:947::2/64 dev t1
45
55
ip -n transmission link set t1 up
56
+
ip -n transmission route add 42:0:ce16::3110/16 via fdb4:3310:947::1 dev t1
46
57
'';
47
58
serviceConfig = {
48
59
RemainAfterExit = true;
49
60
Type = "oneshot";
50
61
};
51
62
};
63
+
64
+
# so we can forward traffic from the transmission network namespace
65
+
boot.kernel.sysctl."net.ipv6.conf.all.forwarding" = 1;
52
66
53
67
systemd.services.transmission = {
54
68
after = [ "transmission-netns.service" ];
+6
2configs/services/flix/default.nix
+6
2configs/services/flix/default.nix
···
270
270
{ predicate = "-i wiregrill -p tcp --dport 4000:4002"; target = "ACCEPT"; }
271
271
{ predicate = "-i wiregrill -p udp --dport 4000:4002"; target = "ACCEPT"; }
272
272
];
273
+
274
+
tables.nat.PREROUTING.rules = [
275
+
# transmission rpc port
276
+
{ predicate = "-i retiolum -p tcp --dport 9091"; target = "DNAT --to-destination fdb4:3310:947::2"; v4 = false; }
277
+
];
278
+
tables.filter.FORWARD.policy = "ACCEPT"; # we need this so we can forward into the the transmission network namespace
273
279
};
274
280
275
281
systemd.services.flix-index = {