Make VPN+Tunnel firewall chains work correctly when used in tandem

Signed-off-by: Mel <mel@rnrd.eu>

1 files changed, 7 insertions, 2 deletions

diff --git a/modules/tunnel/ingress.nix b/modules/tunnel/ingress.nix
index a62e931..f1b7991 100644
--- a/modules/tunnel/ingress.nix
+++ b/modules/tunnel/ingress.nix
@@ -122,12 +122,17 @@ in
       family = "inet";
       content = ''
         chain forward {
-          type filter hook forward priority 0; policy drop;
+          # default accept so forwarding unrelated to the tunnel passes
+          type filter hook forward priority 0; policy accept;
 
-          tcp flags syn tcp option maxseg size set rt mtu
+          iifname { "${ingressInterfaces}" } tcp flags syn tcp option maxseg size set rt mtu
 
           iifname { "${ingressInterfaces}" } oifname "${egressName}" accept
           iifname "${egressName}" oifname { "${ingressInterfaces}" } accept
+
+          # drop route packets that weren't accepted, pass everything else
+          iifname { "${ingressInterfaces}", "${egressName}" } drop
+          oifname { "${ingressInterfaces}", "${egressName}" } drop
         }
       '';
     };