diff options
| author | lassulus <lassulus@lassul.us> | 2017-07-23 21:43:12 +0200 |
|---|---|---|
| committer | lassulus <lassulus@lassul.us> | 2017-07-23 21:43:12 +0200 |
| commit | 6841ba4855cb6743f3591ec0f381d70ca9998eb2 (patch) | |
| tree | 19fbb5dff1c71464d15ba8b6243d2fc4023e2197 | |
| parent | ffc21fa4b1a9f94ee0b5d604b7df95f61cfddb7d (diff) | |
l: add container-networking.nix
| -rw-r--r-- | lass/1systems/prism/config.nix | 1 | ||||
| -rw-r--r-- | lass/2configs/container-networking.nix | 27 |
2 files changed, 28 insertions, 0 deletions
diff --git a/lass/1systems/prism/config.nix b/lass/1systems/prism/config.nix index b13e6bd62..e8beed605 100644 --- a/lass/1systems/prism/config.nix +++ b/lass/1systems/prism/config.nix @@ -42,6 +42,7 @@ in { <stockholm/lass/2configs/syncthing.nix> <stockholm/lass/2configs/coders-irc.nix> <stockholm/lass/2configs/ciko.nix> + <stockholm/lass/2configs/container-networking.nix> { lass.pyload.enable = true; } diff --git a/lass/2configs/container-networking.nix b/lass/2configs/container-networking.nix new file mode 100644 index 000000000..3dae3420d --- /dev/null +++ b/lass/2configs/container-networking.nix @@ -0,0 +1,27 @@ +{ ... }: + +{ + #krebs.iptables.tables.filter.INPUT.rules = [ + # { v6 = false; predicate = "-i ve-+ -p udp -m udp --dport 53"; target = "ACCEPT"; } + # { v6 = false; predicate = "-i ve-+ -p tcp -m tcp --dport 53"; target = "ACCEPT"; } + # { v6 = false; predicate = "-i ve-+ -p udp -m udp --dport 67"; target = "ACCEPT"; } + # { v6 = false; predicate = "-i ve-+ -p tcp -m tcp --dport 67"; target = "ACCEPT"; } + #]; + krebs.iptables.tables.filter.FORWARD.rules = [ + { v6 = false; predicate = "-d 10.233.2.0/24 -o ve-+ -m conntrack --ctstate RELATED,ESTABLISHED"; target = "ACCEPT"; } + { v6 = false; predicate = "-s 10.233.2.0/24 -i ve-+"; target = "ACCEPT"; } + { v6 = false; predicate = "-i ve-+ -o ve-+"; target = "ACCEPT"; } + { v6 = false; predicate = "-o ve-+"; target = "REJECT --reject-with icmp-port-unreachable"; } + { v6 = false; predicate = "-i ve-+"; target = "REJECT --reject-with icmp-port-unreachable"; } + ]; + #krebs.iptables.tables.filter.OUTPUT.rules = [ + # { v6 = false; predicate = "-o ve-+ -p udp -m udp --dport 68"; target = "ACCEPT"; } + #]; + krebs.iptables.tables.nat.POSTROUTING.rules = [ + { v6 = false; predicate = "-s 10.233.2.0/24 -d 224.0.0.0/24"; target = "RETURN"; } + { v6 = false; predicate = "-s 10.233.2.0/24 -d 255.255.255.255"; target = "RETURN"; } + { v6 = false; predicate = "-s 10.233.2.0/24 ! -d 10.233.2.0/24"; target = "MASQUERADE"; } + { v6 = false; predicate = "-s 10.233.2.0/24 ! -d 10.233.2.0/24 -p tcp"; target = "MASQUERADE --to-ports 1024-65535"; } + { v6 = false; predicate = "-s 10.233.2.0/24 ! -d 10.233.2.0/24 -p udp"; target = "MASQUERADE --to-ports 1024-65535"; } + ]; +} |