diff options
| author | makefu <github@syntax-fehler.de> | 2023-01-30 23:43:04 +0100 |
|---|---|---|
| committer | makefu <github@syntax-fehler.de> | 2023-01-30 23:43:04 +0100 |
| commit | 369fa6b7eb3f0fa3e1034bcad438eeda017949f8 (patch) | |
| tree | 22f7891595fba32a7e66b755617e0d49b91993f3 /lass/2configs/riot.nix | |
| parent | dbc3870841223051e4f617b4c06065c168c69c10 (diff) | |
| parent | c7417c8bc1b50d466dae493ac3619d9f324f34f8 (diff) | |
Merge remote-tracking branch 'lass/master'
Diffstat (limited to 'lass/2configs/riot.nix')
| -rw-r--r-- | lass/2configs/riot.nix | 14 |
1 files changed, 9 insertions, 5 deletions
diff --git a/lass/2configs/riot.nix b/lass/2configs/riot.nix index 559e7b20d..6aacec5b6 100644 --- a/lass/2configs/riot.nix +++ b/lass/2configs/riot.nix @@ -31,27 +31,31 @@ privateNetwork = true; hostAddress = "10.233.1.1"; localAddress = "10.233.1.2"; - forwardPorts = [ - { hostPort = 45622; containerPort = 22; } - ]; }; systemd.network.networks."50-ve-riot" = { matchConfig.Name = "ve-riot"; networkConfig = { - IPForward = "yes"; # weirdly we have to use POSTROUTING MASQUERADE here + # and set ip_forward manually + # IPForward = "yes"; # IPMasquerade = "both"; LinkLocalAddressing = "no"; KeepConfiguration = "static"; }; }; - # networking.nat can be used instead of this + boot.kernel.sysctl."net.ipv4.ip_forward" = lib.mkDefault 1; + krebs.iptables.tables.nat.POSTROUTING.rules = [ { v6 = false; predicate = "-s ${config.containers.riot.localAddress}"; target = "MASQUERADE"; } ]; + + # networking.nat can be used instead of this + krebs.iptables.tables.nat.PREROUTING.rules = [ + { predicate = "-p tcp --dport 45622"; target = "DNAT --to-destination ${config.containers.riot.localAddress}:22"; v6 = false; } + ]; krebs.iptables.tables.filter.FORWARD.rules = [ { predicate = "-i ve-riot"; target = "ACCEPT"; } { predicate = "-o ve-riot"; target = "ACCEPT"; } |