diff options
| author | Mel <mel@rnrd.eu> | 2026-06-17 00:27:17 +0200 |
|---|---|---|
| committer | Mel <mel@rnrd.eu> | 2026-06-17 00:27:17 +0200 |
| commit | 997f5a88d6b08d4172cc759f32c314b5a843d81c (patch) | |
| tree | c09d26ea947c563565baf3b16e4b723075e2e2d3 /modules | |
| parent | a4f17c0cce27b6f05234edfb2d545848937484c7 (diff) | |
| download | network-997f5a88d6b08d4172cc759f32c314b5a843d81c.tar.zst network-997f5a88d6b08d4172cc759f32c314b5a843d81c.zip | |
Make VPN+Tunnel firewall chains work correctly when used in tandem
Signed-off-by: Mel <mel@rnrd.eu>
Diffstat (limited to 'modules')
| -rw-r--r-- | modules/foundation/vpn.nix | 3 | ||||
| -rw-r--r-- | modules/tunnel/ingress.nix | 9 |
2 files changed, 10 insertions, 2 deletions
diff --git a/modules/foundation/vpn.nix b/modules/foundation/vpn.nix index 1a7524d..f4a5d21 100644 --- a/modules/foundation/vpn.nix +++ b/modules/foundation/vpn.nix @@ -83,6 +83,9 @@ in type filter hook forward priority 0; policy accept; iifname "${interface}" oifname "${cfg.externalInterface}" accept iifname "${cfg.externalInterface}" oifname "${interface}" ct state established,related accept + + # drop vpn-sourced traffic headed anywhere but external + iifname "${interface}" drop } ''; }; diff --git a/modules/tunnel/ingress.nix b/modules/tunnel/ingress.nix index a62e931..f1b7991 100644 --- a/modules/tunnel/ingress.nix +++ b/modules/tunnel/ingress.nix @@ -122,12 +122,17 @@ in family = "inet"; content = '' chain forward { - type filter hook forward priority 0; policy drop; + # default accept so forwarding unrelated to the tunnel passes + type filter hook forward priority 0; policy accept; - tcp flags syn tcp option maxseg size set rt mtu + iifname { "${ingressInterfaces}" } tcp flags syn tcp option maxseg size set rt mtu iifname { "${ingressInterfaces}" } oifname "${egressName}" accept iifname "${egressName}" oifname { "${ingressInterfaces}" } accept + + # drop route packets that weren't accepted, pass everything else + iifname { "${ingressInterfaces}", "${egressName}" } drop + oifname { "${ingressInterfaces}", "${egressName}" } drop } ''; }; |