summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authortv <tv@krebsco.de>2023-06-06 15:30:02 +0200
committertv <tv@krebsco.de>2023-06-06 15:30:02 +0200
commitd3ed4dec9c77b9453e4a7d1eb043c9b70c173388 (patch)
treec515c68b36aa526fd56c35683613e2d8dc71d19d
parented299eb76953c23ea47ea27b73e9822531e49c7f (diff)
tv sshd: admit hosts without IPv4 addresses
-rw-r--r--tv/2configs/sshd.nix12
1 files changed, 8 insertions, 4 deletions
diff --git a/tv/2configs/sshd.nix b/tv/2configs/sshd.nix
index 33856ac12..0610e3c98 100644
--- a/tv/2configs/sshd.nix
+++ b/tv/2configs/sshd.nix
@@ -9,10 +9,14 @@ in {
tv.iptables.extra.nat.OUTPUT = [
"-o lo -p tcp --dport 11423 -j REDIRECT --to-ports 22"
];
- tv.iptables.extra4.nat.PREROUTING = [
- "-d ${cfg.host.nets.retiolum.ip4.addr} -p tcp --dport 22 -j ACCEPT"
- "-d ${cfg.host.nets.wiregrill.ip4.addr} -p tcp --dport 22 -j ACCEPT"
- ];
+ tv.iptables.extra4.nat.PREROUTING =
+ map
+ (net: "-d ${net.ip4.addr} -p tcp --dport 22 -j ACCEPT")
+ (filter (net: net.ip4 != null)
+ [
+ cfg.host.nets.retiolum
+ cfg.host.nets.wiregrill
+ ]);
tv.iptables.extra6.nat.PREROUTING = [
"-d ${cfg.host.nets.retiolum.ip6.addr} -p tcp --dport 22 -j ACCEPT"
"-d ${cfg.host.nets.wiregrill.ip6.addr} -p tcp --dport 22 -j ACCEPT"