summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authortv <tv@krebsco.de>2020-10-17 01:00:54 +0200
committertv <tv@krebsco.de>2020-10-17 01:00:54 +0200
commitb034f63f7a2e4361b32c33c0e1a980eecf1a5aa6 (patch)
treea14a685952924182f998f0c8e7814bb750d1fac8
parent4d5c1b6dbed3c07c030e1dfe9f033f707608d84a (diff)
tv iptables: move sshd stuff to sshd config
-rw-r--r--tv/2configs/sshd.nix20
-rw-r--r--tv/3modules/iptables.nix9
2 files changed, 17 insertions, 12 deletions
diff --git a/tv/2configs/sshd.nix b/tv/2configs/sshd.nix
index 25468f23e..79af5b01f 100644
--- a/tv/2configs/sshd.nix
+++ b/tv/2configs/sshd.nix
@@ -1,10 +1,22 @@
-{ config, lib, pkgs, ... }:
-
with import <stockholm/lib>;
-
-{
+{ config, ... }: let
+ cfg.host = config.krebs.build.host;
+in {
services.openssh = {
enable = true;
};
tv.iptables.input-internet-accept-tcp = singleton "ssh";
+ tv.iptables.extra.nat.OUTPUT = [
+ "-o lo -p tcp --dport 11423 -j REDIRECT --to-ports 22"
+ ];
+ tv.iptables.extra4.nat.PREROUTING = [
+ "-d ${cfg.host.nets.retiolum.ip4.addr} -p tcp --dport 22 -j ACCEPT"
+ ];
+ tv.iptables.extra6.nat.PREROUTING = [
+ "-d ${cfg.host.nets.retiolum.ip6.addr} -p tcp --dport 22 -j ACCEPT"
+ ];
+ tv.iptables.extra.nat.PREROUTING = [
+ "-p tcp --dport 22 -j REDIRECT --to-ports 0"
+ "-p tcp --dport 11423 -j REDIRECT --to-ports 22"
+ ];
}
diff --git a/tv/3modules/iptables.nix b/tv/3modules/iptables.nix
index 3974760d5..9cf0bd5a2 100644
--- a/tv/3modules/iptables.nix
+++ b/tv/3modules/iptables.nix
@@ -135,15 +135,8 @@ let {
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
- ${concatMapStringsSep "\n" (rule: "-A PREROUTING ${rule}") [
- "! -i retiolum -p tcp -m tcp --dport 22 -j REDIRECT --to-ports 0"
- "-p tcp -m tcp --dport 11423 -j REDIRECT --to-ports 22"
- ]}
- ${concatMapStringsSep "\n" (rule: "-A OUTPUT ${rule}") [
- "-o lo -p tcp -m tcp --dport 11423 -j REDIRECT --to-ports 22"
- ]}
- ${formatTable cfg.extra.nat}
${formatTable cfg."extra${toString iptables-version}".nat}
+ ${formatTable cfg.extra.nat}
COMMIT
*filter
:INPUT DROP [0:0]