···

       
528
       
 
       
        '';

     

       
529
       
 
       
    };

     

       
530
       
 
       


     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
531
       
 
       
    virtualisation.vlans =

     

       
532
       
 
       
      mkOption {

     

       
533
       
 
       
        type = types.listOf types.ints.unsigned;

     
···

       
934
       
 
       
              else "'guestfwd=${proto}:${guest.address}:${toString guest.port}-" +

     

       
935
       
 
       
                   "cmd:${pkgs.netcat}/bin/nc ${host.address} ${toString host.port}',"

     

       
936
       
 
       
          );

     

       
0
       
 
       

     

       
937
       
 
       
      in

     

       
938
       
 
       
      [

     

       
939
       
 
       
        "-net nic,netdev=user.0,model=virtio"

     

       
940
       
-
       
        "-netdev user,id=user.0,${forwardingOptions}\"$QEMU_NET_OPTS\""

     

       
941
       
 
       
      ];

     

       
942
       
 
       


     

       
943
       
 
       
    # FIXME: Consolidate this one day.

     

···

       
528
       
 
       
        '';

     

       
529
       
 
       
    };

     

       
530
       
 
       


     

       
531
       
+
       
    virtualisation.restrictNetwork =

     

       
532
       
+
       
      mkOption {

     

       
533
       
+
       
        type = types.bool;

     

       
534
       
+
       
        default = false;

     

       
535
       
+
       
        example = true;

     

       
536
       
+
       
        description =

     

       
537
       
+
       
          lib.mdDoc ''

     

       
538
       
+
       
            If this option is enabled, the guest will be isolated, i.e. it will

     

       
539
       
+
       
            not be able to contact the host and no guest IP packets will be

     

       
540
       
+
       
            routed over the host to the outside. This option does not affect

     

       
541
       
+
       
            any explicitly set forwarding rules.

     

       
542
       
+
       
          '';

     

       
543
       
+
       
      };

     

       
544
       
+
       


     

       
545
       
 
       
    virtualisation.vlans =

     

       
546
       
 
       
      mkOption {

     

       
547
       
 
       
        type = types.listOf types.ints.unsigned;

     
···

       
948
       
 
       
              else "'guestfwd=${proto}:${guest.address}:${toString guest.port}-" +

     

       
949
       
 
       
                   "cmd:${pkgs.netcat}/bin/nc ${host.address} ${toString host.port}',"

     

       
950
       
 
       
          );

     

       
951
       
+
       
        restrictNetworkOption = lib.optionalString cfg.restrictNetwork "restrict=on,";

     

       
952
       
 
       
      in

     

       
953
       
 
       
      [

     

       
954
       
 
       
        "-net nic,netdev=user.0,model=virtio"

     

       
955
       
+
       
        "-netdev user,id=user.0,${forwardingOptions}${restrictNetworkOption}\"$QEMU_NET_OPTS\""

     

       
956
       
 
       
      ];

     

       
957
       
 
       


     

       
958
       
 
       
    # FIXME: Consolidate this one day.