From 997f5a88d6b08d4172cc759f32c314b5a843d81c Mon Sep 17 00:00:00 2001 From: Mel Date: Wed, 17 Jun 2026 00:27:17 +0200 Subject: Make VPN+Tunnel firewall chains work correctly when used in tandem Signed-off-by: Mel --- modules/tunnel/ingress.nix | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) (limited to 'modules/tunnel/ingress.nix') diff --git a/modules/tunnel/ingress.nix b/modules/tunnel/ingress.nix index a62e931..f1b7991 100644 --- a/modules/tunnel/ingress.nix +++ b/modules/tunnel/ingress.nix @@ -122,12 +122,17 @@ in family = "inet"; content = '' chain forward { - type filter hook forward priority 0; policy drop; + # default accept so forwarding unrelated to the tunnel passes + type filter hook forward priority 0; policy accept; - tcp flags syn tcp option maxseg size set rt mtu + iifname { "${ingressInterfaces}" } tcp flags syn tcp option maxseg size set rt mtu iifname { "${ingressInterfaces}" } oifname "${egressName}" accept iifname "${egressName}" oifname { "${ingressInterfaces}" } accept + + # drop route packets that weren't accepted, pass everything else + iifname { "${ingressInterfaces}", "${egressName}" } drop + oifname { "${ingressInterfaces}", "${egressName}" } drop } ''; }; -- cgit 1.4.1