diff options
| author | tv <tv@krebsco.de> | 2023-06-06 15:30:02 +0200 |
|---|---|---|
| committer | tv <tv@krebsco.de> | 2023-06-06 15:30:02 +0200 |
| commit | d3ed4dec9c77b9453e4a7d1eb043c9b70c173388 (patch) | |
| tree | c515c68b36aa526fd56c35683613e2d8dc71d19d /tv | |
| parent | ed299eb76953c23ea47ea27b73e9822531e49c7f (diff) | |
tv sshd: admit hosts without IPv4 addresses
Diffstat (limited to 'tv')
| -rw-r--r-- | tv/2configs/sshd.nix | 12 |
1 files changed, 8 insertions, 4 deletions
diff --git a/tv/2configs/sshd.nix b/tv/2configs/sshd.nix index 33856ac12..0610e3c98 100644 --- a/tv/2configs/sshd.nix +++ b/tv/2configs/sshd.nix @@ -9,10 +9,14 @@ in { tv.iptables.extra.nat.OUTPUT = [ "-o lo -p tcp --dport 11423 -j REDIRECT --to-ports 22" ]; - tv.iptables.extra4.nat.PREROUTING = [ - "-d ${cfg.host.nets.retiolum.ip4.addr} -p tcp --dport 22 -j ACCEPT" - "-d ${cfg.host.nets.wiregrill.ip4.addr} -p tcp --dport 22 -j ACCEPT" - ]; + tv.iptables.extra4.nat.PREROUTING = + map + (net: "-d ${net.ip4.addr} -p tcp --dport 22 -j ACCEPT") + (filter (net: net.ip4 != null) + [ + cfg.host.nets.retiolum + cfg.host.nets.wiregrill + ]); tv.iptables.extra6.nat.PREROUTING = [ "-d ${cfg.host.nets.retiolum.ip6.addr} -p tcp --dport 22 -j ACCEPT" "-d ${cfg.host.nets.wiregrill.ip6.addr} -p tcp --dport 22 -j ACCEPT" |