feat(router): isolate subnets on firewall

ajgon · ajgon · commit f9a60669f8be · 2024-06-28T22:30:52.000+02:00
diff --git a/nix/machines/router/modules/firewall.nix b/nix/machines/router/modules/firewall.nix
@@ -19,11 +19,12 @@
           type filter hook input priority filter; policy accept;
         }
         chain FORWARD {
-          type filter hook forward priority filter; policy accept;
+          type filter hook forward priority filter; policy drop;
           ct state related,established accept
           iifname "mgmt0" oifname "wan0" accept
           iifname "trst0" oifname "wan0" accept
           iifname "untrst0" oifname "wan0" accept
+          ip daddr 10.99.0.0/16 iifname "trst0" accept
         }
         chain OUTPUT {
           type filter hook output priority filter; policy accept;

Original file line number	Diff line number	Diff line change
`@@ -19,11 +19,12 @@`
`19`	`19`	`type filter hook input priority filter; policy accept;`
`20`	`20`	`}`
`21`	`21`	`chain FORWARD {`
`22`		`- type filter hook forward priority filter; policy accept;`
	`22`	`+ type filter hook forward priority filter; policy drop;`
`23`	`23`	`ct state related,established accept`
`24`	`24`	`iifname "mgmt0" oifname "wan0" accept`
`25`	`25`	`iifname "trst0" oifname "wan0" accept`
`26`	`26`	`iifname "untrst0" oifname "wan0" accept`
	`27`	`+ ip daddr 10.99.0.0/16 iifname "trst0" accept`
`27`	`28`	`}`
`28`	`29`	`chain OUTPUT {`
`29`	`30`	`type filter hook output priority filter; policy accept;`