summaryrefslogtreecommitdiffstats
path: root/tv/3modules/iptables.nix
diff options
context:
space:
mode:
authormakefu <github@syntax-fehler.de>2016-02-22 14:35:59 +0100
committermakefu <github@syntax-fehler.de>2016-02-22 14:35:59 +0100
commitb25d15573ab10a4b2dd55e46291fbab6adf70162 (patch)
tree1036547a8003c5767565d53d748d83d3614271b6 /tv/3modules/iptables.nix
parent5b7039f1f11e7cf2da6f3735cc7d99322a31c7a5 (diff)
parent8393444dce1888d369955e46dd16983a43762bb9 (diff)
Merge remote-tracking branch 'cd/master'
Diffstat (limited to 'tv/3modules/iptables.nix')
-rw-r--r--tv/3modules/iptables.nix22
1 files changed, 22 insertions, 0 deletions
diff --git a/tv/3modules/iptables.nix b/tv/3modules/iptables.nix
index c0fd7ec12..c0e71f24d 100644
--- a/tv/3modules/iptables.nix
+++ b/tv/3modules/iptables.nix
@@ -26,6 +26,21 @@ let
type = with types; listOf (either int str);
default = [];
};
+
+ extra = {
+ nat.POSTROUTING = mkOption {
+ type = with types; listOf str;
+ default = [];
+ };
+ filter.FORWARD = mkOption {
+ type = with types; listOf str;
+ default = [];
+ };
+ filter.INPUT = mkOption {
+ type = with types; listOf str;
+ default = [];
+ };
+ };
};
imp = {
@@ -57,6 +72,11 @@ let
};
};
+ formatTable = table:
+ (concatStringsSep "\n"
+ (mapAttrsToList
+ (chain: concatMapStringsSep "\n" (rule: "-A ${chain} ${rule}"))
+ table));
rules = iptables-version: let
accept-echo-request = {
@@ -79,6 +99,7 @@ let
${concatMapStringsSep "\n" (rule: "-A OUTPUT ${rule}") [
"-o lo -p tcp -m tcp --dport 11423 -j REDIRECT --to-ports 22"
]}
+ ${formatTable cfg.extra.nat}
COMMIT
*filter
:INPUT DROP [0:0]
@@ -94,6 +115,7 @@ let
++ map accept-new-tcp (unique (map toString cfg.input-internet-accept-new-tcp))
++ ["-i retiolum -j Retiolum"]
)}
+ ${formatTable cfg.extra.filter}
${concatMapStringsSep "\n" (rule: "-A Retiolum ${rule}") ([]
++ optional (cfg.accept-echo-request == "retiolum") accept-echo-request
++ map accept-new-tcp (unique (map toString cfg.input-retiolum-accept-new-tcp))