maralorn/nixos-config
1
0
Fork 0
Code Wiki Activity

Try fixing nat

Browse source
This commit is contained in:
Malte 2023-04-27 07:51:29 +02:00
parent 0ba66cf899
commit 893ed52a9f
1 changed files with 35 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

43
nixos/machines/hera/network.nix
View file

@ -10,8 +10,35 @@ in {
m-0.tailscale-routes = "fd42:ccc:da:64::/64,172.20.64.0/24"; m-0.tailscale-routes = "fd42:ccc:da:64::/64,172.20.64.0/24";
networking = { networking = {
nftables.ruleset = '' nftables.ruleset = ''
table ip nixos-nat { chain post { iifname tailscale0 oifname tinc.cdark.net masquerade comment "snat queries to hackspace";};} table ip nixos-nat {
table ip6 nixos-nat { chain post { iifname tailscale0 oifname tinc.cdark.net masquerade comment "snat queries to hackspace";};} chain pre {
type nat hook prerouting priority dstnat; policy accept;
}
chain post {
type nat hook postrouting priority srcnat; policy accept;
iifname "bridge" oifname "ens18" masquerade comment "from internal interfaces"
iifname "tailscale0" oifname "tinc.cdark.net" masquerade comment "snat queries to hackspace"
}
chain out {
type nat hook output priority mangle; policy accept;
}
}
table ip6 nixos-nat {
chain pre {
type nat hook prerouting priority dstnat; policy accept;
}
chain post {
type nat hook postrouting priority srcnat; policy accept;
iifname "tailscale0" oifname "tinc.cdark.net" masquerade comment "snat queries to hackspace"
}
chain out {
type nat hook output priority mangle; policy accept;
}
}
''; '';
hostName = "hera"; hostName = "hera";
domain = "m-0.eu"; domain = "m-0.eu";
@ -52,12 +79,12 @@ in {
} }
]; ];
}; };
nat = { #nat = {
enable = true; # enable = true;
enableIPv6 = true; # enableIPv6 = true;
externalInterface = "ens18"; # externalInterface = "ens18";
internalInterfaces = ["bridge"]; # internalInterfaces = ["bridge"];
}; #};
nameservers = ["213.136.95.10" "2a02:c207::1:53" "2a02:c207::2:53"]; nameservers = ["213.136.95.10" "2a02:c207::1:53" "2a02:c207::2:53"];
firewall.allowedTCPPorts = [8666]; firewall.allowedTCPPorts = [8666];
#firewall.allowedUDPPorts = [wireguard.port]; #firewall.allowedUDPPorts = [wireguard.port];