summaryrefslogtreecommitdiff
path: root/hosts/apocalypse/firewall.nix
diff options
context:
space:
mode:
Diffstat (limited to 'hosts/apocalypse/firewall.nix')
-rw-r--r--hosts/apocalypse/firewall.nix46
1 files changed, 24 insertions, 22 deletions
diff --git a/hosts/apocalypse/firewall.nix b/hosts/apocalypse/firewall.nix
index 8cf3e61..4be34a3 100644
--- a/hosts/apocalypse/firewall.nix
+++ b/hosts/apocalypse/firewall.nix
@@ -33,27 +33,29 @@ let
];
in
{
- networking.nftables.enable = true;
- networking.firewall = {
- enable = true;
- checkReversePath = false;
- allowedTCPPorts = baseTCP;
- allowedUDPPorts = baseUDP;
- allowedUDPPortRanges = baseUDPRanges;
- allowedTCPPortRanges = baseTCPRanges;
- interfaces = {
- "nix-laptop" = {
- allowedTCPPorts = secureTCP;
- allowedUDPPorts = secureUDP;
- allowedUDPPortRanges = secureUDPRanges;
- allowedTCPPortRanges = secureTCPRanges;
- };
- };
- trustedInterfaces = [
- "docker0"
- "br-*"
- "veth*"
- ];
+ networking.nftables.enable = true;
+ networking.firewall = {
+ enable = true;
+ checkReversePath = false;
+ allowedTCPPorts = baseTCP;
+ allowedUDPPorts = baseUDP;
+ allowedUDPPortRanges = baseUDPRanges;
+ allowedTCPPortRanges = baseTCPRanges;
+ interfaces = {
+ "nix-laptop" = {
+ allowedTCPPorts = secureTCP;
+ allowedUDPPorts = secureUDP;
+ allowedUDPPortRanges = secureUDPRanges;
+ allowedTCPPortRanges = secureTCPRanges;
+ };
};
-}
+ trustedInterfaces = [
+ "docker0"
+ "br-*"
+ "veth*"
+ "vnet*"
+ "virbr*"
+ ];
+ };
+}