greg/nixos
1
0
Fork 2
Code Issues Pull Requests 3 Actions Packages Projects Releases Wiki Activity

Update ZWaveJS

Browse Source 
Update to newer version of ZWaveJS container
Update firewall rules to permit access to podman0
This commit is contained in:
Greg Hellings
2023-08-31 08:01:46 -05:00
parent 1d3c7eaa03
commit 03edc9a8af
2 changed files with 11 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hosts/genesis/nftables.nft
+7 -3
View File
@@ -8,7 +8,6 @@ table ip filter {
counter tcp_dns {}
counter udp_dns {}
counter catchall {}
counter sus {}
chain output {
type filter hook output priority 100; policy accept;
@@ -18,7 +17,6 @@ table ip filter {
type filter hook input priority 0; policy drop;
iifname lo accept
iifname $SUS counter name sus
# Router needs to yield up DNS and DHCP for itself, in my case
iifname $LAN tcp dport { 53, 67 } counter name tcp_dns accept
@@ -31,15 +29,20 @@ table ip filter {
iifname $FRIENDS udp dport {{ port }} accept
{% endfor %}
iifname $LAN counter name catchall accept comment "Allows LAN traffic and outgoing"
#iifname $LAN counter name catchall accept comment "Allows LAN traffic and outgoing"
iifname {{ wanInterface }} ct state { established, related } accept comment "Allows existing connections"
iifname {{ wanInterface }} icmp type { echo-request, destination-unreachable, time-exceeded } accept comment "Allow some ICMP traffic"
iifname {{ wanInterface }} counter drop comment "Drop other incoming traffic, and count how much"
iifname "podman0" ct state { established, related } accept comment "Allows existing connections"
iifname "podman0" icmp type { echo-request, destination-unreachable, time-exceeded } accept comment "Allow some ICMP traffic"
iifname "podman0" counter drop comment "Drop other incoming traffic, and count how much"
}
chain forward {
type filter hook forward priority 0; policy drop;
iifname $LAN oifname {{ wanInterface }} accept comment "Forward LAN to WAN"
iifname {{ wanInterface }} oifname $LAN ct state established, related accept comment "Allow incoming established traffic"
iifname $LAN oifname "podman0" accept comment "Forward LAN to WAN"
iifname "podman0" oifname $LAN ct state established, related accept comment "Allow incoming established traffic"
}
}
@@ -47,6 +50,7 @@ table ip nat {
chain postrouting {
type nat hook postrouting priority 100; policy accept;
oifname { {{ wanInterface }} } masquerade
oifname "podman0" masquerade
}
}