···

       
12
       
 
       


     

       
13
       
 
       
  dest = if cfg.externalIP == null then "-j MASQUERADE" else "-j SNAT --to-source ${cfg.externalIP}";

     

       
14
       
 
       


     

       
15
       
-
       
  externalInterfaceFilter = param:

     

       
16
       
-
       
    optionalString (cfg.externalInterface != null) "${param} ${cfg.externalInterface}";

     

       
17
       
-
       


     

       
18
       
 
       
  flushNat = ''

     

       
19
       
 
       
    iptables -w -t nat -D PREROUTING -j nixos-nat-pre 2>/dev/null|| true

     

       
20
       
 
       
    iptables -w -t nat -F nixos-nat-pre 2>/dev/null || true

     
···

       
39
       
 
       
    # NAT the marked packets.

     

       
40
       
 
       
    ${optionalString (cfg.internalInterfaces != []) ''

     

       
41
       
 
       
      iptables -w -t nat -A nixos-nat-post -m mark --mark 1 \

     

       
42
       
-
       
        ${externalInterfaceFilter "-o"} ${dest}

     

       
43
       
 
       
    ''}

     

       
44
       
 
       


     

       
45
       
 
       
    # NAT packets coming from the internal IPs.

     

       
46
       
 
       
    ${concatMapStrings (range: ''

     

       
47
       
 
       
      iptables -w -t nat -A nixos-nat-post \

     

       
48
       
-
       
        -s '${range}' \! -d '${range}'

     

       
49
       
-
       
        ${externalInterfaceFilter "-o"} ${dest}

     

       
50
       
 
       
    '') cfg.internalIPs}

     

       
51
       
 
       


     

       
52
       
 
       
    # NAT from external ports to internal ports.

     

       
53
       
 
       
    ${concatMapStrings (fwd: ''

     

       
54
       
 
       
      iptables -w -t nat -A nixos-nat-pre \

     

       
55
       
-
       
        ${externalInterfaceFilter "-i"} -p tcp \

     

       
56
       
 
       
        --dport ${builtins.toString fwd.sourcePort} \

     

       
57
       
 
       
        -j DNAT --to-destination ${fwd.destination}

     

       
58
       
 
       
    '') cfg.forwardPorts}

     
···

       
104
       
 
       
    };

     

       
105
       
 
       


     

       
106
       
 
       
    networking.nat.externalInterface = mkOption {

     

       
107
       
-
       
      type = types.nullOr types.str;

     

       
108
       
-
       
      default = null;

     

       
109
       
 
       
      example = "eth1";

     

       
110
       
 
       
      description =

     

       
111
       
 
       
        ''

     

···

       
12
       
 
       


     

       
13
       
 
       
  dest = if cfg.externalIP == null then "-j MASQUERADE" else "-j SNAT --to-source ${cfg.externalIP}";

     

       
14
       
 
       


     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
15
       
 
       
  flushNat = ''

     

       
16
       
 
       
    iptables -w -t nat -D PREROUTING -j nixos-nat-pre 2>/dev/null|| true

     

       
17
       
 
       
    iptables -w -t nat -F nixos-nat-pre 2>/dev/null || true

     
···

       
36
       
 
       
    # NAT the marked packets.

     

       
37
       
 
       
    ${optionalString (cfg.internalInterfaces != []) ''

     

       
38
       
 
       
      iptables -w -t nat -A nixos-nat-post -m mark --mark 1 \

     

       
39
       
+
       
        -o ${cfg.externalInterface} ${dest}

     

       
40
       
 
       
    ''}

     

       
41
       
 
       


     

       
42
       
 
       
    # NAT packets coming from the internal IPs.

     

       
43
       
 
       
    ${concatMapStrings (range: ''

     

       
44
       
 
       
      iptables -w -t nat -A nixos-nat-post \

     

       
45
       
+
       
        -s '${range}' -o ${cfg.externalInterface} ${dest}

     

       
0
       
 
       

     

       
46
       
 
       
    '') cfg.internalIPs}

     

       
47
       
 
       


     

       
48
       
 
       
    # NAT from external ports to internal ports.

     

       
49
       
 
       
    ${concatMapStrings (fwd: ''

     

       
50
       
 
       
      iptables -w -t nat -A nixos-nat-pre \

     

       
51
       
+
       
        -i ${cfg.externalInterface} -p tcp \

     

       
52
       
 
       
        --dport ${builtins.toString fwd.sourcePort} \

     

       
53
       
 
       
        -j DNAT --to-destination ${fwd.destination}

     

       
54
       
 
       
    '') cfg.forwardPorts}

     
···

       
100
       
 
       
    };

     

       
101
       
 
       


     

       
102
       
 
       
    networking.nat.externalInterface = mkOption {

     

       
103
       
+
       
      type = types.str;

     

       
0
       
 
       

     

       
104
       
 
       
      example = "eth1";

     

       
105
       
 
       
      description =

     

       
106
       
 
       
        ''