rope/nixos
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

router: count isolated-device drops so the rule is verifiable

Browse source 
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
rope 2026-09-12 12:59:22 +01:00
parent 33db456c4c
commit 1f472fcafe
1 changed files with 5 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

6
services/router.nix
View file

@ -52,8 +52,12 @@ let
# ponytail: MAC-based like blockRules, so it inherits the same weakness — a
# device that randomises its MAC walks around it. Fine for an IP camera,
# which won't; match on the DHCP-reserved IP too if that ever changes.
# `counter` so the rule is self-verifying: `nft list chain inet filter
# forward` shows how much the device has tried to send off-LAN. A climbing
# number means isolation is doing work; a flat zero means either a quiet
# device or a rule that stopped matching, and those are worth telling apart.
isolateRules = lib.concatMapStringsSep "\n "
(d: ''iifname "eth0" ether saddr ${d.mac} drop comment "${d.name} isolated (no routing)"'')
(d: ''iifname "eth0" ether saddr ${d.mac} counter drop comment "${d.name} isolated (no routing)"'')
isolatedDevices;
# Phase-1 transition list; empty now that eero is in bridge mode and