1 files changed, 15 insertions, 7 deletions

diff --git a/hosts/vidhar/network/ruleset.nft b/hosts/vidhar/network/ruleset.nft
index da3a9048..d2c88008 100644
--- a/hosts/vidhar/network/ruleset.nft
+++ b/hosts/vidhar/network/ruleset.nft
@@ -59,6 +59,9 @@ table inet filter {
   counter fw-lo {}
   counter fw-lan {}
   counter fw-dsl {}
+  counter fw-printing {}
+
+  counter fw-cups {}
 
   counter reject-ratelimit-fw {}
   counter reject-fw {}
@@ -137,12 +140,17 @@ table inet filter {
 
     iifname lo counter name fw-lo accept
 
-    oifname { lan, dsl, bifrost } meta l4proto $icmp_protos jump forward_icmp_accept
-
+    oifname { lan, dsl, bifrost, ve-printing } meta l4proto $icmp_protos jump forward_icmp_accept
     iifname lan oifname { dsl, bifrost } counter name fw-lan accept
-    iifname dsl oifname { lan, dmz01 } ct state {established, related} counter name fw-dsl accept
 
 
+    iifname lan oifname ve-printing ip daddr 10.141.4.1 tcp dport 631 counter name fw-cups accept
+    iifname lan oifname ve-printing ip6 daddr 2a03:4000:52:ada:4::1 tcp dport 631 counter name fw-cups accept
+
+
+    iifname ve-printing oifname lan ct state {established, related} counter name fw-printing accept
+    iifname dsl oifname lan ct state {established, related} counter name fw-dsl accept
+
 
     limit name lim_reject log level debug prefix "drop forward: " counter name reject-ratelimit-fw drop
     log level debug prefix "reject forward: " counter name reject-fw
@@ -169,7 +177,7 @@ table inet filter {
     iifname { lan, mgmt, dsl, yggdrasil, bifrost } tcp dport 22 counter name ssh-rx accept
     iifname { lan, mgmt, dsl, yggdrasil, bifrost } udp dport 60000-61000 counter name mosh-rx accept
 
-    iifname { lan, mgmt, dmz01, yggdrasil } meta l4proto { tcp, udp } th dport 53 counter name dns-rx accept
+    iifname { lan, mgmt, wifibh, yggdrasil, ve-printing } meta l4proto { tcp, udp } th dport 53 counter name dns-rx accept
 
     iifname { lan, yggdrasil } tcp dport 2049 counter name nfs-rx accept
 
@@ -179,9 +187,9 @@ table inet filter {
 
     iifname dsl meta protocol ip6 udp dport 546 udp sport 547 counter name ipv6-pd-rx accept
 
-    iifname mgmt udp dport 123 counter name ntp-rx accept
+    iifname { mgmt, ve-printing } udp dport 123 counter name ntp-rx accept
 
-    iifname { lan, mgmt, dmz01 } udp dport 67 counter name dhcp-rx accept
+    iifname { lan, mgmt, wifibh } udp dport 67 counter name dhcp-rx accept
 
     iifname lan udp dport { 137, 138, 3702 } counter name samba-rx accept
     iifname lan tcp dport { 445, 139, 5357 } counter name samba-rx accept
@@ -268,4 +276,4 @@ table ip mss_clamp {
 
     oifname dsl tcp flags & (syn|rst) == syn counter name dsl-mss-clamp tcp option maxseg size set rt mtu
   }
-}
\ No newline at end of file
+}