nixos-module/container/upstream: prohibit forwarding smtp except for serv

pull/9/head
Astro 7 months ago
parent 99dbdf23ff
commit 32f4b3bd84

@ -57,10 +57,24 @@ in
internalInterfaces = [ "core" ];
externalInterface = firstUpstreamInterface;
externalIP = upstreamInterfaces.${firstUpstreamInterface}.upstream.staticIpv4Address;
extraCommands =
extraCommands = ''
# Prohibit SMTP except for servers
iptables -N fwd_smtp
iptables -A fwd_smtp --source ${config.site.net.serv.subnet4} -j RETURN
iptables -A fwd_smtp -j REJECT
iptables -I FORWARD -p tcp --dport 25 -j fwd_smtp
ip6tables -N fwd_smtp
${lib.concatMapStrings (subnet6: ''
ip6tables -A fwd_smtp --source ${subnet6} -j RETURN
ip6tables -A fwd_smtp --dest ${subnet6} -j RETURN
'') (builtins.attrValues config.site.net.serv.subnets6)}
ip6tables -A fwd_smtp -j REJECT
ip6tables -I FORWARD -p tcp --dport 25 -j fwd_smtp
# Provide IPv6 upstream for everyone, using NAT66 when not from
# our static prefixes
lib.concatMapStringsSep "\n" (net: ''
${lib.concatMapStringsSep "\n" (net: ''
ip6tables -t nat -N ${net}_nat || \
ip6tables -t nat -F ${net}_nat
${lib.concatMapStringsSep "\n" (subnet: ''
@ -73,13 +87,18 @@ in
ip6tables -t nat -A POSTROUTING \
-o ${net} \
-j ${net}_nat
'') (builtins.attrNames upstreamInterfaces);
extraStopCommands =
lib.concatMapStringsSep "\n" (net: ''
ip6tables -t nat -F POSTROUTING 2>/dev/null || true
'') (builtins.attrNames upstreamInterfaces)}
'';
extraStopCommands = ''
iptables -F FORWARD 2>/dev/null || true
ip6tables -F FORWARD 2>/dev/null || true
ip6tables -t nat -F POSTROUTING 2>/dev/null || true
${lib.concatMapStringsSep "\n" (net: ''
ip6tables -t nat -F ${net}_nat 2>/dev/null || true
ip6tables -t nat -X ${net}_nat 2>/dev/null || true
'') (builtins.attrNames upstreamInterfaces);
'') (builtins.attrNames upstreamInterfaces)}
'';
forwardPorts = map ({ destination, sourcePort, reflect, ... }@forwardedPort:
removeAttrs forwardedPort ["reflect"] // {

Loading…
Cancel
Save