rope/nixos
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

router: allow pelican0 bridge through firewall

Browse source
This commit is contained in:
rope 2026-08-27 20:19:34 +01:00
parent c19f7b4a2b
commit f38bb57514
1 changed files with 4 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

6
services/router.nix
View file

@ -153,7 +153,8 @@ in
# Container bridges reaching host services (e.g. Profilarr → Radarr # Container bridges reaching host services (e.g. Profilarr → Radarr
# on 10.0.0.1:7878, Forgejo runner → AdGuard DNS). br-* covers # on 10.0.0.1:7878, Forgejo runner → AdGuard DNS). br-* covers
# Docker user-defined networks, podman* covers Podman (rootful). # Docker user-defined networks, podman* covers Podman (rootful).
iifname { "docker0", "br-*", "podman*" } accept # pelican0 is wings' own bridge (config.yml names it), so br-* misses it.
iifname { "docker0", "br-*", "podman*", "pelican0" } accept
# Phase 1: also trust the existing eero subnet on eno1 so SSH # Phase 1: also trust the existing eero subnet on eno1 so SSH
# and AdGuard DNS keep working during the transition. # and AdGuard DNS keep working during the transition.
${legacyTrustRules} ${legacyTrustRules}
@ -173,7 +174,8 @@ in
iifname "eth0" accept iifname "eth0" accept
# Containers → anywhere (image pulls, Forgejo runner workflows, # Containers → anywhere (image pulls, Forgejo runner workflows,
# etc.). br-* = Docker custom networks, podman* = Podman rootful. # etc.). br-* = Docker custom networks, podman* = Podman rootful.
iifname { "docker0", "br-*", "podman*" } accept # pelican0 = wings' bridge; it does not match br-*.
iifname { "docker0", "br-*", "podman*", "pelican0" } accept
# WAN → any port-forward target (LAN host or docker container) # WAN → any port-forward target (LAN host or docker container)
iifname "eno1" ct status dnat accept iifname "eno1" ct status dnat accept
} }