makefu/stockholm
1
0
Fork 0
Code Issues Pull requests Actions1 Packages Projects Releases Wiki Activity

l riot: use iptables for port forwarding

Browse source
This commit is contained in:
lassulus 2023-01-18 20:03:06 +01:00
parent c9339846fd
commit ad1320ce80
1 changed files with 9 additions and 5 deletions

14
lass/2configs/riot.nix
View file

@ -31,27 +31,31 @@
privateNetwork = true;
hostAddress = "10.233.1.1";
localAddress = "10.233.1.2";
forwardPorts = [
{ hostPort = 45622; containerPort = 22; }
];
};
systemd.network.networks."50-ve-riot" = {
matchConfig.Name = "ve-riot";
networkConfig = {
IPForward = "yes";
# weirdly we have to use POSTROUTING MASQUERADE here
# and set ip_forward manually
# IPForward = "yes";
# IPMasquerade = "both";
LinkLocalAddressing = "no";
KeepConfiguration = "static";
};
};
# networking.nat can be used instead of this
boot.kernel.sysctl."net.ipv4.ip_forward" = lib.mkDefault 1;
krebs.iptables.tables.nat.POSTROUTING.rules = [
{ v6 = false; predicate = "-s ${config.containers.riot.localAddress}"; target = "MASQUERADE"; }
];
# networking.nat can be used instead of this
krebs.iptables.tables.nat.PREROUTING.rules = [
{ predicate = "-p tcp --dport 45622"; target = "DNAT --to-destination ${config.containers.riot.localAddress}:22"; v6 = false; }
];
krebs.iptables.tables.filter.FORWARD.rules = [
{ predicate = "-i ve-riot"; target = "ACCEPT"; }
{ predicate = "-o ve-riot"; target = "ACCEPT"; }