From ef39030d83fb488b16035c82f1f876ed103f541a Mon Sep 17 00:00:00 2001 From: Gregor Kleen Date: Sun, 5 Mar 2023 11:20:27 +0100 Subject: ... --- hosts/vidhar/printing/default.nix | 14 +++++++------- hosts/vidhar/printing/ruleset.nft | 11 ++++++----- 2 files changed, 13 insertions(+), 12 deletions(-) (limited to 'hosts/vidhar/printing') diff --git a/hosts/vidhar/printing/default.nix b/hosts/vidhar/printing/default.nix index 0e0dfcf7..d844823b 100644 --- a/hosts/vidhar/printing/default.nix +++ b/hosts/vidhar/printing/default.nix @@ -10,10 +10,10 @@ in { privateNetwork = true; ephemeral = true; autoStart = true; - hostAddress = "10.141.4.0"; - hostAddress6 = "2a03:4000:52:ada:4::"; - localAddress = "10.141.4.1"; - localAddress6 = "2a03:4000:52:ada:4::1"; + hostAddress = "10.141.5.0"; + hostAddress6 = "2a03:4000:52:ada:5::"; + localAddress = "10.141.5.1"; + localAddress6 = "2a03:4000:52:ada:5::1"; interfaces = [ "printer" ]; config = let hostConfig = config; @@ -42,10 +42,10 @@ in { { subnet = "10.141.3.0/24"; option-data = [ { name = "domain-name-servers"; - data = "10.141.4.0"; + data = "10.141.5.0"; } { name = "ntp-servers"; - data = "10.141.4.0"; + data = "10.141.5.0"; } { name = "broadcast-address"; data = "10.141.3.255"; @@ -81,7 +81,7 @@ in { allowFrom = [ "all" ]; extraConf = '' ServerName printing - ServerAlias 10.141.4.1 2a03:4000:52:ada:4::1 printing.vidhar.yggdrasil printing.vidhar.lan.yggdrasil + ServerAlias 10.141.5.1 2a03:4000:52:ada:5::1 printing.vidhar.yggdrasil printing.vidhar.lan.yggdrasil ''; }; diff --git a/hosts/vidhar/printing/ruleset.nft b/hosts/vidhar/printing/ruleset.nft index c3027567..e47256c3 100644 --- a/hosts/vidhar/printing/ruleset.nft +++ b/hosts/vidhar/printing/ruleset.nft @@ -44,6 +44,7 @@ table inet filter { counter fw-printer {} counter fw-host {} + counter icmp-fw {} counter icmp-ratelimit-fw {} counter reject-ratelimit-fw {} @@ -97,9 +98,9 @@ table inet filter { meta l4proto $icmp_protos counter name icmp-fw accept - iifname printer oifname eth0 ip daddr 10.141.4.0 meta l4proto . th dport { tcp . 53, udp . 53, udp . 123 } counter fw-printer accept - iifname printer oifname eth0 ip6 daddr 2a03:4000:52:ada:4:: meta l4proto . th dport { tcp . 53, udp . 53, udp . 123 } counter fw-printer accept - iifname eth0 oifname printer counter fw-host accept + iifname printer oifname eth0 ip daddr 10.141.5.0 meta l4proto . th dport { tcp . 53, udp . 53, udp . 123 } counter name fw-printer accept + iifname printer oifname eth0 ip6 daddr 2a03:4000:52:ada:5:: meta l4proto . th dport { tcp . 53, udp . 53, udp . 123 } counter name fw-printer accept + iifname eth0 oifname printer counter name fw-host accept limit name lim_reject log level debug prefix "drop forward: " counter name reject-ratelimit-fw drop @@ -127,8 +128,8 @@ table inet filter { meta l4proto $icmp_protos counter name icmp-rx accept - ip6 saddr 2a03:4000:52:ada:4:: tcp dport 631 counter name cups-rx accept - ip saddr 10.141.4.0 tcp dport 631 counter name cups-rx accept + ip6 saddr 2a03:4000:52:ada:5:: tcp dport 631 counter name cups-rx accept + ip saddr 10.141.5.0 tcp dport 631 counter name cups-rx accept ct state {established, related} counter name established-rx accept -- cgit v1.2.3