summaryrefslogtreecommitdiffstats
path: root/lass/1systems/yellow
diff options
context:
space:
mode:
authorlassulus <lassulus@lassul.us>2022-12-11 19:07:58 +0100
committerlassulus <lassulus@lassul.us>2022-12-11 19:07:58 +0100
commit85c76178209c506149b17c01218b89cc34a78966 (patch)
treef94e04440aed864ea532a43114d7c11cf43449a5 /lass/1systems/yellow
parent4cb2771732108d16728021e17099dfda6e21f5fe (diff)
l yellow.r: allow traffic only through vpn
Diffstat (limited to 'lass/1systems/yellow')
-rw-r--r--lass/1systems/yellow/config.nix19
1 files changed, 15 insertions, 4 deletions
diff --git a/lass/1systems/yellow/config.nix b/lass/1systems/yellow/config.nix
index f5071c4b7..519665a3d 100644
--- a/lass/1systems/yellow/config.nix
+++ b/lass/1systems/yellow/config.nix
@@ -1,6 +1,6 @@
-with import <stockholm/lib>;
-{ config, lib, pkgs, ... }:
-{
+{ config, lib, pkgs, ... }: let
+ vpnIp = "85.202.81.161";
+in {
imports = [
<stockholm/lass>
<stockholm/lass/2configs>
@@ -11,6 +11,8 @@ with import <stockholm/lib>;
users.groups.download.members = [ "transmission" ];
+ networking.useHostResolvConf = false;
+ networking.useNetworkd = true;
systemd.services.transmission.bindsTo = [ "openvpn-nordvpn.service" ];
systemd.services.transmission.after = [ "openvpn-nordvpn.service" ];
services.transmission = {
@@ -159,13 +161,22 @@ with import <stockholm/lib>;
{ predicate = "-p udp --dport 51413"; target = "ACCEPT"; } # transmission-traffic
{ predicate = "-p tcp --dport 8096"; target = "ACCEPT"; } # jellyfin
];
+ tables.filter.OUTPUT = {
+ policy = "DROP";
+ rules = [
+ { v6 = false; predicate = "-d ${vpnIp}/32"; target = "ACCEPT"; }
+ { predicate = "-o tun0"; target = "ACCEPT"; }
+ { predicate = "-o retiolum"; target = "ACCEPT"; }
+ { v6 = false; predicate = "-o eth0 -d 10.233.0.0/24"; target = "ACCEPT"; }
+ ];
+ };
};
services.openvpn.servers.nordvpn.config = ''
client
dev tun
proto udp
- remote 194.110.84.106 1194
+ remote ${vpnIp} 1194
resolv-retry infinite
remote-random
nobind