rope/nixos
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Reflect Pelican game ports for LAN clients

Browse source
This commit is contained in:
rope 2026-09-15 14:59:40 +01:00
parent 85b1c3ecbf
commit 214845d71e
1 changed files with 18 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

18
services/router.nix
View file

@ -83,6 +83,18 @@ let
forwards = lib.concatMap expandForward portsData.forward; forwards = lib.concatMap expandForward portsData.forward;
# LAN clients normally resolve nordhammer.it to 10.0.0.1 through AdGuard.
# Some game/browser stacks retain or independently resolve the public WAN
# address, though. Reflect only Pelican's allocation range back to its LAN
# destination so those clients take the same path as an external player.
# Selecting the declared forward keeps this in sync with ports.toml.
pelicanForwards = builtins.filter
(f: f.name == "Pelican game servers")
forwards;
lanGameReflectionRules = lib.concatMapStringsSep "\n "
(f: ''${f.proto} dport ${f.port} dnat to ${f.dest} comment "${f.name} LAN reflection"'')
pelicanForwards;
# nftables accepts port-range literals like "26901-26902" as-is. # nftables accepts port-range literals like "26901-26902" as-is.
dnatRules = lib.concatMapStringsSep "\n " dnatRules = lib.concatMapStringsSep "\n "
(f: ''${f.proto} dport ${f.port} dnat to ${f.dest} comment "${f.name}"'') (f: ''${f.proto} dport ${f.port} dnat to ${f.dest} comment "${f.name}"'')
@ -286,10 +298,16 @@ in
chain prerouting { chain prerouting {
type nat hook prerouting priority -100; policy accept; type nat hook prerouting priority -100; policy accept;
iifname "eno1" jump port_forwards iifname "eno1" jump port_forwards
# Hairpin only public/local-address requests from the LAN. Direct
# 10.0.0.x traffic and every non-Pelican port remain untouched.
iifname "eth0" ip daddr != 10.0.0.0/24 fib daddr type local jump lan_game_reflection
} }
chain port_forwards { chain port_forwards {
${dnatRules} ${dnatRules}
} }
chain lan_game_reflection {
${lanGameReflectionRules}
}
chain postrouting { chain postrouting {
type nat hook postrouting priority 100; policy accept; type nat hook postrouting priority 100; policy accept;
oifname "eno1" masquerade oifname "eno1" masquerade