voronind/nix
0
0
Fork 0
Code Issues 40 Pull requests Packages Projects Releases Wiki Activity

Home: Block some routes in local.

Browse source
This commit is contained in:
Dmitry Voronin 2024-12-08 23:59:53 +03:00
parent 99471d18e9
commit 1f285488e0
1 changed files with 11 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
host/x86_64-linux/home/Network.nix
View file

@ -153,13 +153,22 @@ in {
firewall = { firewall = {
enable = true; enable = true;
extraCommands = util.trimTabs '' extraCommands = util.trimTabs ''
# Wan access for 10.0.0.0/24 subnet. # Wan access for 10.0.0.0/8 subnet.
iptables -t nat -A POSTROUTING -s 10.0.0.0/24 -d 0/0 -o ${wan} -j MASQUERADE # iptables -t nat -A POSTROUTING -s 10.0.0.0/8 -d 0/0 -o ${wan} -j MASQUERADE
# Full access from Lan. # Full access from Lan.
iptables -I INPUT -j ACCEPT -i ${lan} -d ${internal} iptables -I INPUT -j ACCEPT -i ${lan} -d ${internal}
ip6tables -I INPUT -j ACCEPT -i ${lan} -d ${internal6} ip6tables -I INPUT -j ACCEPT -i ${lan} -d ${internal6}
# Block wrong routes. TODO fix.
iptables -I INPUT -j REJECT -i ${lan} -d 169.254.15.92
iptables -I INPUT -j REJECT -i ${lan} -d 188.242.247.132
iptables -I INPUT -j REJECT -i ${lan} -d 192.168.142.113
iptables -I INPUT -j REJECT -i ${lan} -d 10.0.1.1
iptables -I INPUT -j REJECT -i ${lan} -d 188.242.247.132
ip6tables -I INPUT -j REJECT -i ${lan} -d 2a05:3580:f42c:c800:aaa1:59ff:fe47:fda2
ip6tables -I INPUT -j REJECT -i ${lan} -d 2a05:3580:f42c:c801:8079:82ff:fe1a:916a
# Public email server. # Public email server.
ip46tables -I INPUT -j ACCEPT -i ${wan} -p tcp --dport 25 ip46tables -I INPUT -j ACCEPT -i ${wan} -p tcp --dport 25