dan
/
liminix
1
0
Fork 5
Code Issues 3 Pull Requests 2 Projects Releases Wiki Activity

allow dhcp client on wan

module-based-network
Daniel Barlow 2023-06-28 23:51:21 +01:00
parent 8affb151b5
commit 1f1164cc98
1 changed files with 11 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
examples/rotuer-firewall.nix
View File

@ -106,6 +106,16 @@ in {
(accept "tcp dport 22")
];
};
input-wan = {
type = "filter";
family = "ip6";
rules = [
(accept "udp dport 546") # dhcp client, needed for prefix delegation
];
};
input-ip6 = {
type = "filter";
family = "ip6";
@ -114,6 +124,7 @@ in {
rules = [
(accept "meta l4proto icmpv6")
"iifname int jump input-lan"
"iifname ppp0 jump input-wan"
(if allow-incoming
then accept "oifname \"int\" iifname \"ppp0\""
else "oifname \"int\" iifname \"ppp0\" jump incoming-allowed-ip6"