commit e8bb94fca93517d5f124380c5f30fcbaf851bae3 · pyrox.dev/nixpkgs

+15 -10
nixos/modules/services/networking/nat.nix
···

       13
       13
        
         dest = if cfg.externalIP == null then "-j MASQUERADE" else "-j SNAT --to-source ${cfg.externalIP}";

     

       14
       14
        
       

     

       15
       15
        
         flushNat = ''

     

       16
       16
       -
           iptables -w -t nat -D PREROUTING -j nixos-nat-pre 2>/dev/null|| true

     

       17
       17
       -
           iptables -w -t nat -F nixos-nat-pre 2>/dev/null || true

     

       18
       18
       -
           iptables -w -t nat -X nixos-nat-pre 2>/dev/null || true

     

       19
       19
       -
           iptables -w -t nat -D POSTROUTING -j nixos-nat-post 2>/dev/null || true

     

       20
       20
       -
           iptables -w -t nat -F nixos-nat-post 2>/dev/null || true

     

       21
       21
       -
           iptables -w -t nat -X nixos-nat-post 2>/dev/null || true

     

       16
       16
       +
           ip46tables -w -t nat -D PREROUTING -j nixos-nat-pre 2>/dev/null|| true

     

       17
       17
       +
           ip46tables -w -t nat -F nixos-nat-pre 2>/dev/null || true

     

       18
       18
       +
           ip46tables -w -t nat -X nixos-nat-pre 2>/dev/null || true

     

       19
       19
       +
           ip46tables -w -t nat -D POSTROUTING -j nixos-nat-post 2>/dev/null || true

     

       20
       20
       +
           ip46tables -w -t nat -F nixos-nat-post 2>/dev/null || true

     

       21
       21
       +
           ip46tables -w -t nat -X nixos-nat-post 2>/dev/null || true

     

       22
       22
       +
           ip46tables -w -t nat -D OUTPUT -j nixos-nat-out 2>/dev/null || true

     

       23
       23
       +
           ip46tables -w -t nat -F nixos-nat-out 2>/dev/null || true

     

       24
       24
       +
           ip46tables -w -t nat -X nixos-nat-out 2>/dev/null || true

     

       22
       25
        
       

     

       23
       26
        
           ${cfg.extraStopCommands}

     

       24
       27
        
         '';

     

       25
       28
        
       

     

       26
       29
        
         setupNat = ''

     

       27
       30
        
           # Create subchain where we store rules

     

       28
       28
       -
           iptables -w -t nat -N nixos-nat-pre

     

       29
       29
       -
           iptables -w -t nat -N nixos-nat-post

     

       31
       31
       +
           ip46tables -w -t nat -N nixos-nat-pre

     

       32
       32
       +
           ip46tables -w -t nat -N nixos-nat-post

     

       33
       33
       +
           ip46tables -w -t nat -N nixos-nat-out

     

       30
       34
        
       

     

       31
       35
        
           # We can't match on incoming interface in POSTROUTING, so

     

       32
       36
        
           # mark packets coming from the internal interfaces.

     
···

       88
       92
        
           ${cfg.extraCommands}

     

       89
       93
        
       

     

       90
       94
        
           # Append our chains to the nat tables

     

       91
       91
       -
           iptables -w -t nat -A PREROUTING -j nixos-nat-pre

     

       92
       92
       -
           iptables -w -t nat -A POSTROUTING -j nixos-nat-post

     

       95
       95
       +
           ip46tables -w -t nat -A PREROUTING -j nixos-nat-pre

     

       96
       96
       +
           ip46tables -w -t nat -A POSTROUTING -j nixos-nat-post

     

       97
       97
       +
           ip46tables -w -t nat -A OUTPUT -j nixos-nat-out

     

       93
       98
        
         '';

     

       94
       99
        
       

     

       95
       100
        
       in