Mic92/stockholm
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

ponte: modify internet-facing SSH port

Browse Source
This commit is contained in:
tv 2022-12-09 18:07:20 +01:00
parent ea30ea8661
commit b17cd6133b
1 changed files with 15 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
krebs/1systems/ponte/config.nix
View File

@ -11,6 +11,21 @@
networking.firewall.logRefusedConnections = false;
networking.firewall.logRefusedUnicastsOnly = false;
# Move Internet-facing SSH port to reduce logspam.
networking.firewall.extraCommands = let
host = config.krebs.build.host;
in /* sh */ ''
iptables -t nat -A OUTPUT -o lo -p tcp --dport 11423 -j REDIRECT --to-ports 22
iptables -t nat -A PREROUTING -p tcp --dport 11423 -j REDIRECT --to-ports 22
iptables -t nat -A PREROUTING -d ${host.nets.retiolum.ip4.addr} -p tcp --dport 22 -j ACCEPT
iptables -t nat -A PREROUTING -p tcp --dport 22 -j REDIRECT --to-ports 0
ip6tables -t nat -A OUTPUT -o lo -p tcp --dport 11423 -j REDIRECT --to-ports 22
ip6tables -t nat -A PREROUTING -p tcp --dport 11423 -j REDIRECT --to-ports 22
ip6tables -t nat -A PREROUTING -d ${host.nets.retiolum.ip6.addr} -p tcp --dport 22 -j ACCEPT
ip6tables -t nat -A PREROUTING -p tcp --dport 22 -j REDIRECT --to-ports 0
'';
krebs.build.host = config.krebs.hosts.ponte;
krebs.pages.enable = true;