liminix

commit 5112eab4da5b24db8dc76be7d3b538f1d2c353d5
parent e383f1b3d33c6ada3e14fd7c063d15bf57494c95
Author: Daniel Barlow <dan@telent.net>
Date:   Thu, 10 Oct 2024 18:18:23 +0100

apply incoming-allowed-ip[46] rules to input as well as forward pkts

this makes it possible to open ports on the router itself

Diffstat:
M
modules/firewall/default-rules.nix
 | 
4
++--

1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/modules/firewall/default-rules.nix b/modules/firewall/default-rules.nix
@@ -90,7 +90,7 @@ in {
       # accept inbound from the WAN
       (if allow-incoming
        then accept "oifname \"int\" iifname \"ppp0\""
-       else "oifname \"int\" iifname \"ppp0\" jump incoming-allowed-ip6"
+       else "iifname \"ppp0\" jump incoming-allowed-ip6"
       )
       # allow all outbound and any inbound that's part of a
       # recognised (outbound-initiated) flow
@@ -210,7 +210,7 @@ in {
       "icmp type { echo-request, echo-reply } accept"
       "iifname int jump input-ip4-lan"
       "iifname ppp0 jump input-ip4-wan"
-      "oifname \"int\" iifname \"ppp0\" jump incoming-allowed-ip4"
+      "iifname ppp0 jump incoming-allowed-ip4"
       "ct state established,related accept"
       "log prefix \"DENIED CHAIN=input-ip4 \""
     ];