mikl/nix-config
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

heather: SNAT Docker egress to AstrNet identity and allow replies

Browse source
This commit is contained in:
heather 2026-09-27 00:17:03 +00:00
commit b014c03b21
1 changed files with 9 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

10
hosts/heather/astrnet.nix
View file

@ -83,7 +83,7 @@ in {
# WireGuard peers use allowedIPs 0/0 as an ACL, so do not rely on a packet's
# source address to identify a particular AstrNet client here.
systemd.services.astrnet-guard = {
description = "Allow AstrNet host ingress; block AstrNet transit";
description = "Allow AstrNet ingress and Docker replies; block new transit";
wantedBy = [ "multi-user.target" ];
requiredBy = [ "wireguard-wg-mic-der.service" "wireguard-wg-mic-bd8.service" ];
before = [ "wireguard-wg-mic-der.service" "wireguard-wg-mic-bd8.service" ];
@ -102,8 +102,16 @@ in {
}
chain forward {
type filter hook forward priority -150; policy accept;
# Only replies to Docker-initiated connections, never new mesh transit.
iifname { "wg-mic-der", "wg-mic-bd8" } ct state established,related accept
iifname { "wg-mic-der", "wg-mic-bd8" } drop
}
chain postrouting {
type nat hook postrouting priority 99; policy accept;
# Docker's own MASQUERADE would use the tunnel transit IP, which
# AstrNet exits do not NAT. Use the advertised mesh identity instead.
oifname { "wg-mic-der", "wg-mic-bd8" } ip saddr { 172.17.0.0/16, 172.18.0.0/16, 172.19.0.0/16 } snat to ${id4}
}
}
RULES
'';