summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--lass/1systems/prism/config.nix1
-rw-r--r--lass/2configs/container-networking.nix27
2 files changed, 28 insertions, 0 deletions
diff --git a/lass/1systems/prism/config.nix b/lass/1systems/prism/config.nix
index b13e6bd62..e8beed605 100644
--- a/lass/1systems/prism/config.nix
+++ b/lass/1systems/prism/config.nix
@@ -42,6 +42,7 @@ in {
<stockholm/lass/2configs/syncthing.nix>
<stockholm/lass/2configs/coders-irc.nix>
<stockholm/lass/2configs/ciko.nix>
+ <stockholm/lass/2configs/container-networking.nix>
{
lass.pyload.enable = true;
}
diff --git a/lass/2configs/container-networking.nix b/lass/2configs/container-networking.nix
new file mode 100644
index 000000000..3dae3420d
--- /dev/null
+++ b/lass/2configs/container-networking.nix
@@ -0,0 +1,27 @@
+{ ... }:
+
+{
+ #krebs.iptables.tables.filter.INPUT.rules = [
+ # { v6 = false; predicate = "-i ve-+ -p udp -m udp --dport 53"; target = "ACCEPT"; }
+ # { v6 = false; predicate = "-i ve-+ -p tcp -m tcp --dport 53"; target = "ACCEPT"; }
+ # { v6 = false; predicate = "-i ve-+ -p udp -m udp --dport 67"; target = "ACCEPT"; }
+ # { v6 = false; predicate = "-i ve-+ -p tcp -m tcp --dport 67"; target = "ACCEPT"; }
+ #];
+ krebs.iptables.tables.filter.FORWARD.rules = [
+ { v6 = false; predicate = "-d 10.233.2.0/24 -o ve-+ -m conntrack --ctstate RELATED,ESTABLISHED"; target = "ACCEPT"; }
+ { v6 = false; predicate = "-s 10.233.2.0/24 -i ve-+"; target = "ACCEPT"; }
+ { v6 = false; predicate = "-i ve-+ -o ve-+"; target = "ACCEPT"; }
+ { v6 = false; predicate = "-o ve-+"; target = "REJECT --reject-with icmp-port-unreachable"; }
+ { v6 = false; predicate = "-i ve-+"; target = "REJECT --reject-with icmp-port-unreachable"; }
+ ];
+ #krebs.iptables.tables.filter.OUTPUT.rules = [
+ # { v6 = false; predicate = "-o ve-+ -p udp -m udp --dport 68"; target = "ACCEPT"; }
+ #];
+ krebs.iptables.tables.nat.POSTROUTING.rules = [
+ { v6 = false; predicate = "-s 10.233.2.0/24 -d 224.0.0.0/24"; target = "RETURN"; }
+ { v6 = false; predicate = "-s 10.233.2.0/24 -d 255.255.255.255"; target = "RETURN"; }
+ { v6 = false; predicate = "-s 10.233.2.0/24 ! -d 10.233.2.0/24"; target = "MASQUERADE"; }
+ { v6 = false; predicate = "-s 10.233.2.0/24 ! -d 10.233.2.0/24 -p tcp"; target = "MASQUERADE --to-ports 1024-65535"; }
+ { v6 = false; predicate = "-s 10.233.2.0/24 ! -d 10.233.2.0/24 -p udp"; target = "MASQUERADE --to-ports 1024-65535"; }
+ ];
+}