···

       
13
       
 
       
  dest = if cfg.externalIP == null then "-j MASQUERADE" else "-j SNAT --to-source ${cfg.externalIP}";

     

       
14
       
 
       


     

       
15
       
 
       
  flushNat = ''

     

       
16
       
-
       
    iptables -w -t nat -D PREROUTING -j nixos-nat-pre 2>/dev/null|| true

     

       
17
       
-
       
    iptables -w -t nat -F nixos-nat-pre 2>/dev/null || true

     

       
18
       
-
       
    iptables -w -t nat -X nixos-nat-pre 2>/dev/null || true

     

       
19
       
-
       
    iptables -w -t nat -D POSTROUTING -j nixos-nat-post 2>/dev/null || true

     

       
20
       
-
       
    iptables -w -t nat -F nixos-nat-post 2>/dev/null || true

     

       
21
       
-
       
    iptables -w -t nat -X nixos-nat-post 2>/dev/null || true

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
22
       
 
       


     

       
23
       
 
       
    ${cfg.extraStopCommands}

     

       
24
       
 
       
  '';

     

       
25
       
 
       


     

       
26
       
 
       
  setupNat = ''

     

       
27
       
 
       
    # Create subchain where we store rules

     

       
28
       
-
       
    iptables -w -t nat -N nixos-nat-pre

     

       
29
       
-
       
    iptables -w -t nat -N nixos-nat-post

     

       
0
       
 
       

     

       
30
       
 
       


     

       
31
       
 
       
    # We can't match on incoming interface in POSTROUTING, so

     

       
32
       
 
       
    # mark packets coming from the internal interfaces.

     
···

       
88
       
 
       
    ${cfg.extraCommands}

     

       
89
       
 
       


     

       
90
       
 
       
    # Append our chains to the nat tables

     

       
91
       
-
       
    iptables -w -t nat -A PREROUTING -j nixos-nat-pre

     

       
92
       
-
       
    iptables -w -t nat -A POSTROUTING -j nixos-nat-post

     

       
0
       
 
       

     

       
93
       
 
       
  '';

     

       
94
       
 
       


     

       
95
       
 
       
in

     

···

       
13
       
 
       
  dest = if cfg.externalIP == null then "-j MASQUERADE" else "-j SNAT --to-source ${cfg.externalIP}";

     

       
14
       
 
       


     

       
15
       
 
       
  flushNat = ''

     

       
16
       
+
       
    ip46tables -w -t nat -D PREROUTING -j nixos-nat-pre 2>/dev/null|| true

     

       
17
       
+
       
    ip46tables -w -t nat -F nixos-nat-pre 2>/dev/null || true

     

       
18
       
+
       
    ip46tables -w -t nat -X nixos-nat-pre 2>/dev/null || true

     

       
19
       
+
       
    ip46tables -w -t nat -D POSTROUTING -j nixos-nat-post 2>/dev/null || true

     

       
20
       
+
       
    ip46tables -w -t nat -F nixos-nat-post 2>/dev/null || true

     

       
21
       
+
       
    ip46tables -w -t nat -X nixos-nat-post 2>/dev/null || true

     

       
22
       
+
       
    ip46tables -w -t nat -D OUTPUT -j nixos-nat-out 2>/dev/null || true

     

       
23
       
+
       
    ip46tables -w -t nat -F nixos-nat-out 2>/dev/null || true

     

       
24
       
+
       
    ip46tables -w -t nat -X nixos-nat-out 2>/dev/null || true

     

       
25
       
 
       


     

       
26
       
 
       
    ${cfg.extraStopCommands}

     

       
27
       
 
       
  '';

     

       
28
       
 
       


     

       
29
       
 
       
  setupNat = ''

     

       
30
       
 
       
    # Create subchain where we store rules

     

       
31
       
+
       
    ip46tables -w -t nat -N nixos-nat-pre

     

       
32
       
+
       
    ip46tables -w -t nat -N nixos-nat-post

     

       
33
       
+
       
    ip46tables -w -t nat -N nixos-nat-out

     

       
34
       
 
       


     

       
35
       
 
       
    # We can't match on incoming interface in POSTROUTING, so

     

       
36
       
 
       
    # mark packets coming from the internal interfaces.

     
···

       
92
       
 
       
    ${cfg.extraCommands}

     

       
93
       
 
       


     

       
94
       
 
       
    # Append our chains to the nat tables

     

       
95
       
+
       
    ip46tables -w -t nat -A PREROUTING -j nixos-nat-pre

     

       
96
       
+
       
    ip46tables -w -t nat -A POSTROUTING -j nixos-nat-post

     

       
97
       
+
       
    ip46tables -w -t nat -A OUTPUT -j nixos-nat-out

     

       
98
       
 
       
  '';

     

       
99
       
 
       


     

       
100
       
 
       
in