summaryrefslogtreecommitdiffstats
path: root/lass/2configs/riot.nix
diff options
context:
space:
mode:
authormakefu <github@syntax-fehler.de>2023-01-30 23:43:04 +0100
committermakefu <github@syntax-fehler.de>2023-01-30 23:43:04 +0100
commit369fa6b7eb3f0fa3e1034bcad438eeda017949f8 (patch)
tree22f7891595fba32a7e66b755617e0d49b91993f3 /lass/2configs/riot.nix
parentdbc3870841223051e4f617b4c06065c168c69c10 (diff)
parentc7417c8bc1b50d466dae493ac3619d9f324f34f8 (diff)
Merge remote-tracking branch 'lass/master'
Diffstat (limited to 'lass/2configs/riot.nix')
-rw-r--r--lass/2configs/riot.nix14
1 files changed, 9 insertions, 5 deletions
diff --git a/lass/2configs/riot.nix b/lass/2configs/riot.nix
index 559e7b20d..6aacec5b6 100644
--- a/lass/2configs/riot.nix
+++ b/lass/2configs/riot.nix
@@ -31,27 +31,31 @@
privateNetwork = true;
hostAddress = "10.233.1.1";
localAddress = "10.233.1.2";
- forwardPorts = [
- { hostPort = 45622; containerPort = 22; }
- ];
};
systemd.network.networks."50-ve-riot" = {
matchConfig.Name = "ve-riot";
networkConfig = {
- IPForward = "yes";
# weirdly we have to use POSTROUTING MASQUERADE here
+ # and set ip_forward manually
+ # IPForward = "yes";
# IPMasquerade = "both";
LinkLocalAddressing = "no";
KeepConfiguration = "static";
};
};
- # networking.nat can be used instead of this
+ boot.kernel.sysctl."net.ipv4.ip_forward" = lib.mkDefault 1;
+
krebs.iptables.tables.nat.POSTROUTING.rules = [
{ v6 = false; predicate = "-s ${config.containers.riot.localAddress}"; target = "MASQUERADE"; }
];
+
+ # networking.nat can be used instead of this
+ krebs.iptables.tables.nat.PREROUTING.rules = [
+ { predicate = "-p tcp --dport 45622"; target = "DNAT --to-destination ${config.containers.riot.localAddress}:22"; v6 = false; }
+ ];
krebs.iptables.tables.filter.FORWARD.rules = [
{ predicate = "-i ve-riot"; target = "ACCEPT"; }
{ predicate = "-o ve-riot"; target = "ACCEPT"; }