summaryrefslogtreecommitdiffstats
path: root/tv/2configs
diff options
context:
space:
mode:
authortv <tv@krebsco.de>2016-02-18 00:50:10 +0100
committertv <tv@krebsco.de>2016-02-18 00:50:10 +0100
commit7f1abe50ce0989d96c3d275a4d0481962848714f (patch)
tree93a9bf5f92e1192001b8d4ee69487eb2c41392cc /tv/2configs
parentf7d6e2043184401f7007b248fbe3af66b2752351 (diff)
xu-qemu0 host: setup iptables
Diffstat (limited to 'tv/2configs')
-rw-r--r--tv/2configs/xu-qemu0.nix18
1 files changed, 12 insertions, 6 deletions
diff --git a/tv/2configs/xu-qemu0.nix b/tv/2configs/xu-qemu0.nix
index 2b67a8b84..5be4899c8 100644
--- a/tv/2configs/xu-qemu0.nix
+++ b/tv/2configs/xu-qemu0.nix
@@ -15,17 +15,23 @@ in
#
# make [install] system=xu-qemu0 target_host=10.56.0.101
-# TODO iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
-# TODO iptables -A FORWARD -i qemubr0 -s 10.56.0.1/24 -m conntrack --ctstate NEW -j ACCEPT
-# TODO iptables -A POSTROUTING -t nat -j MASQUERADE
-# TODO iptables -A INPUT -i qemubr0 -p udp -m udp --dport bootps -j ACCEPT
-# TODO iptables -A INPUT -i qemubr0 -p udp -m udp --dport domain -j ACCEPT
-
with config.krebs.lib;
{
networking.dhcpcd.denyInterfaces = [ "qemubr0" ];
+ tv.iptables.extra = {
+ nat.POSTROUTING = ["-j MASQUERADE"];
+ filter.FORWARD = [
+ "-m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT"
+ "-i qemubr0 -s 10.56.0.1/24 -m conntrack --ctstate NEW -j ACCEPT"
+ ];
+ filter.INPUT = [
+ "-i qemubr0 -p udp -m udp --dport bootps -j ACCEPT"
+ "-i qemubr0 -p udp -m udp --dport domain -j ACCEPT"
+ ];
+ };
+
systemd.network.enable = true;
systemd.services.systemd-networkd-wait-online.enable = false;