summaryrefslogtreecommitdiffstats
path: root/lass/2configs/wiregrill.nix
diff options
context:
space:
mode:
Diffstat (limited to 'lass/2configs/wiregrill.nix')
-rw-r--r--lass/2configs/wiregrill.nix14
1 files changed, 7 insertions, 7 deletions
diff --git a/lass/2configs/wiregrill.nix b/lass/2configs/wiregrill.nix
index ba6358ab7..a27e99ee2 100644
--- a/lass/2configs/wiregrill.nix
+++ b/lass/2configs/wiregrill.nix
@@ -16,13 +16,13 @@ in mkIf (hasAttr "wiregrill" config.krebs.build.host.nets) {
krebs.iptables.tables.filter.INPUT.rules = [
{ predicate = "-p udp --dport ${toString self.wireguard.port}"; target = "ACCEPT"; }
];
- krebs.iptables.tables.filter.FORWARD.rules = mkIf isRouter [
- { precedence = 1000; predicate = "-i wiregrill -o wiregrill"; target = "ACCEPT"; }
- { precedence = 1000; predicate = "-i wiregrill -o retiolum"; target = "ACCEPT"; }
- { precedence = 1000; predicate = "-i retiolum -o wiregrill"; target = "ACCEPT"; }
- { precedence = 1000; predicate = "-i wiregrill -o eth0"; target = "ACCEPT"; }
- { precedence = 1000; predicate = "-o wiregrill -m conntrack --ctstate RELATED,ESTABLISHED"; target = "ACCEPT"; }
- ];
+ krebs.iptables.tables.filter.FORWARD.rules = mkIf isRouter (mkBefore [
+ { predicate = "-i wiregrill -o wiregrill"; target = "ACCEPT"; }
+ { predicate = "-i wiregrill -o retiolum"; target = "ACCEPT"; }
+ { predicate = "-i retiolum -o wiregrill"; target = "ACCEPT"; }
+ { predicate = "-i wiregrill -o eth0"; target = "ACCEPT"; }
+ { predicate = "-o wiregrill -m conntrack --ctstate RELATED,ESTABLISHED"; target = "ACCEPT"; }
+ ]);
systemd.network.networks.wiregrill = {
matchConfig.Name = "wiregrill";
address =