From 997f5a88d6b08d4172cc759f32c314b5a843d81c Mon Sep 17 00:00:00 2001
From: Mel <mel@rnrd.eu>
Date: Wed, 17 Jun 2026 00:27:17 +0200
Subject: Make VPN+Tunnel firewall chains work correctly when used in tandem

Signed-off-by: Mel <mel@rnrd.eu>
---
 modules/foundation/vpn.nix | 3 +++
 1 file changed, 3 insertions(+)

(limited to 'modules/foundation')

diff --git a/modules/foundation/vpn.nix b/modules/foundation/vpn.nix
index 1a7524d..f4a5d21 100644
--- a/modules/foundation/vpn.nix
+++ b/modules/foundation/vpn.nix
@@ -83,6 +83,9 @@ in
           type filter hook forward priority 0; policy accept;
           iifname "${interface}" oifname "${cfg.externalInterface}" accept
           iifname "${cfg.externalInterface}" oifname "${interface}" ct state established,related accept
+
+          # drop vpn-sourced traffic headed anywhere but external
+          iifname "${interface}" drop
         }
       '';
     };
-- 
cgit 1.4.1