liminix

commit 1f1164cc98252a9e990658f6ab068d1519a6b618
parent 8affb151b51a11d76a94c8920d38696756b67a17
Author: Daniel Barlow <dan@telent.net>
Date:   Wed, 28 Jun 2023 23:51:21 +0100

allow dhcp client on wan

Diffstat:
M
examples/rotuer-firewall.nix
 | 
11
+++++++++++

1 file changed, 11 insertions(+), 0 deletions(-)
diff --git a/examples/rotuer-firewall.nix b/examples/rotuer-firewall.nix
@@ -106,6 +106,16 @@ in {
       (accept "tcp dport 22")
     ];
   };
+
+  input-wan = {
+    type = "filter";
+    family = "ip6";
+
+    rules = [
+      (accept "udp dport 546") # dhcp client, needed for prefix delegation
+    ];
+  };
+
   input-ip6 = {
     type = "filter";
     family = "ip6";
@@ -114,6 +124,7 @@ in {
     rules = [
       (accept "meta l4proto icmpv6")
       "iifname int jump input-lan"
+      "iifname ppp0 jump input-wan"
       (if allow-incoming
        then accept "oifname \"int\" iifname \"ppp0\""
        else "oifname \"int\" iifname \"ppp0\" jump incoming-allowed-ip6"