liminix

commit a654577ac2a35b2ffc998698ee3c19b94a4562ef
parent c50423f68974ab2e587d2379ae126291b3d57599
Author: Daniel Barlow <dan@telent.net>
Date:   Mon, 12 Feb 2024 21:05:01 +0000

improve port-forwarding comment

Diffstat:
M
examples/demo-firewall.nix
 | 
6
++++--

1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/examples/demo-firewall.nix b/examples/demo-firewall.nix
@@ -234,8 +234,10 @@ in {
     family = "ip";
     rules = [
       # This is where you put permitted incoming connections. If
-      # you're using NAT, the rules in this chain will see the
-      # internal (RFC1918) addresses.
+      # you're using NAT and want to forward a port from outside to
+      # devices on the LAN, then you need a DNAT rule in nat-rx chain
+      # *and* to accept the packet in this chain (specifying the
+      # internal (RFC1918) address).
     ];
   };