commit 3942cbea6717b518c80c8342da96775718652ed3 · pyrox.dev/nixpkgs

+32 -1
nixos/modules/services/networking/nat.nix
···

       53
       53
        
               -i ${cfg.externalInterface} -p ${fwd.proto} \

     

       54
       54
        
               --dport ${builtins.toString fwd.sourcePort} \

     

       55
       55
        
               -j DNAT --to-destination ${fwd.destination}

     

       56
       56
       +
       

     

       57
       57
       +
             ${concatMapStrings (loopbackip:

     

       58
       58
       +
               let

     

       59
       59
       +
                 m                = builtins.match "([0-9.]+):([0-9-]+)" fwd.destination;

     

       60
       60
       +
                 destinationIP    = if (m == null) then throw "bad ip:ports `${fwd.destination}'" else elemAt m 0;

     

       61
       61
       +
                 destinationPorts = if (m == null) then throw "bad ip:ports `${fwd.destination}'" else elemAt m 1;

     

       62
       62
       +
               in ''

     

       63
       63
       +
                 # Allow connections to ${loopbackip}:${toString fwd.sourcePort} from the host itself

     

       64
       64
       +
                 iptables -w -t nat -A OUTPUT \

     

       65
       65
       +
                   -d ${loopbackip} -p ${fwd.proto} \

     

       66
       66
       +
                   --dport ${builtins.toString fwd.sourcePort} \

     

       67
       67
       +
                   -j DNAT --to-destination ${fwd.destination}

     

       68
       68
       +
       

     

       69
       69
       +
                 # Allow connections to ${loopbackip}:${toString fwd.sourcePort} from other hosts behind NAT

     

       70
       70
       +
                 iptables -w -t nat -A nixos-nat-pre \

     

       71
       71
       +
                   -d ${loopbackip} -p ${fwd.proto} \

     

       72
       72
       +
                   --dport ${builtins.toString fwd.sourcePort} \

     

       73
       73
       +
                   -j DNAT --to-destination ${fwd.destination}

     

       74
       74
       +
       

     

       75
       75
       +
                 iptables -w -t nat -A nixos-nat-post \

     

       76
       76
       +
                   -d ${destinationIP} -p ${fwd.proto} \

     

       77
       77
       +
                   --dport ${destinationPorts} \

     

       78
       78
       +
                   -j SNAT --to-source ${loopbackip}

     

       79
       79
       +
               '') fwd.loopbackIPs}

     

       56
       80
        
           '') cfg.forwardPorts}

     

       57
       81
        
       

     

       58
       82
        
           ${optionalString (cfg.dmzHost != null) ''

     

       59
       83
        
             iptables -w -t nat -A nixos-nat-pre \

     

       60
       84
        
               -i ${cfg.externalInterface} -j DNAT \

     

       61
       61
       -
       	--to-destination ${cfg.dmzHost}

     

       85
       85
       +
               --to-destination ${cfg.dmzHost}

     

       62
       86
        
           ''}

     

       63
       87
        
       

     

       64
       88
        
           ${cfg.extraCommands}

     
···

       151
       175
        
                   default = "tcp";

     

       152
       176
        
                   example = "udp";

     

       153
       177
        
                   description = "Protocol of forwarded connection";

     

       178
       178
       +
                 };

     

       179
       179
       +
       

     

       180
       180
       +
                 loopbackIPs = mkOption {

     

       181
       181
       +
                   type = types.listOf types.str;

     

       182
       182
       +
                   default = [];

     

       183
       183
       +
                   example = literalExample ''[ "55.1.2.3" ]'';

     

       184
       184
       +
                   description = "Public IPs for NAT reflection; for connections to `loopbackip:sourcePort' from the host itself and from other hosts behind NAT";

     

       154
       185
        
                 };

     

       155
       186
        
               };

     

       156
       187
        
             });