summaryrefslogtreecommitdiffstats
path: root/lass/2configs/wiregrill.nix
diff options
context:
space:
mode:
authorlassulus <lassulus@lassul.us>2022-05-29 20:13:53 +0200
committerlassulus <lassulus@lassul.us>2022-05-29 20:13:53 +0200
commit85db8852793af6a2d20d281aec768597b027a619 (patch)
treed4e5e6a0d8ce4646616aaffe4e8645dfdb554493 /lass/2configs/wiregrill.nix
parent1bf8ca72402124875b44d9745be03408dacf5b15 (diff)
l wiregrill: allow retiolum <-> wiregrill
Diffstat (limited to 'lass/2configs/wiregrill.nix')
-rw-r--r--lass/2configs/wiregrill.nix4
1 files changed, 4 insertions, 0 deletions
diff --git a/lass/2configs/wiregrill.nix b/lass/2configs/wiregrill.nix
index 0183bd4e5..54257d2c4 100644
--- a/lass/2configs/wiregrill.nix
+++ b/lass/2configs/wiregrill.nix
@@ -18,6 +18,10 @@ in mkIf (hasAttr "wiregrill" config.krebs.build.host.nets) {
];
krebs.iptables.tables.filter.FORWARD.rules = mkIf isRouter [
{ precedence = 1000; predicate = "-i wiregrill -o wiregrill"; target = "ACCEPT"; }
+ { precedence = 1000; predicate = "-i wiregrill -o retiolum"; target = "ACCEPT"; }
+ { precedence = 1000; predicate = "-i retiolum -o wiregrill"; target = "ACCEPT"; }
+ { precedence = 1000; predicate = "-i wiregrill -o eth0"; target = "ACCEPT"; }
+ { precedence = 1000; predicate = "-o wiregrill -m conntrack --ctstate RELATED,ESTABLISHED"; target = "ACCEPT"; }
];
networking.wireguard.interfaces.wiregrill = {