steveej/infra
1
0
Fork 0
Code Issues 2 Pull requests Projects Releases Packages Wiki Activity Actions

router0-dmz0: expose a DMZ host

Browse source
This commit is contained in:
steveej 2023-12-28 13:56:57 +01:00
parent e9f48238e0
commit 940b295c17
1 changed files with 27 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

30
nix/os/devices/router0-dmz0/configuration.nix
View file

@ -173,9 +173,26 @@ in {
# https://github.com/thelegy/nixos-nftables-firewall/tree/main
# TODO: configure packet_priority for VLANs (see https://wiki.nftables.org/wiki-nftables/index.php/Configuring_chains#Base_chain_priority, https://wiki.nftables.org/wiki-nftables/index.php/Setting_packet_metainformation#packet_priority)
nftables = {
nftables =
{
enable = true;
stopRuleset = "";
chains = {
prerouting = {
"redirectweb" = {
after = ["hook"];
rules = let
wanInterfaces = builtins.concatStringsSep ", " config.networking.nftables.firewall.zones.wan.interfaces;
exposedHost = "192.168.22.121";
in [
"iifname { ${wanInterfaces} } tcp dport 220 redirect to 22"
"iifname { ${wanInterfaces} } dnat ip to ${exposedHost}"
];
};
};
};
firewall = {
enable = true;
zones = {
@ -260,6 +277,12 @@ in {
verdict = "accept";
};
wan-to-dmz = {
from = ["wan"];
to = ["dmz"];
verdict = "accept";
};
wan-to-fw = {
from = ["wan"];
to = ["fw"];
@ -740,8 +763,9 @@ in {
proxy-dnssec = true;
conntrack = true;
log-debug = true;
log-queries = true;
# enable for debugging
# log-debug = true;
# log-queries = true;
# disable negative caching
no-negcache = true;