mikl/nix-config
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

heather: allow bounded AstrNet ICMP echo on own addresses

Browse source
This commit is contained in:
heather 2026-09-26 23:25:31 +00:00
commit f69f67d36a
1 changed files with 7 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

9
hosts/heather/astrnet.nix
View file

@ -49,7 +49,8 @@ in {
# Heather's public firewall is disabled (the cloud SG is the WAN barrier). # Heather's public firewall is disabled (the cloud SG is the WAN barrier).
# Explicitly restrict traffic FROM AstrNet before normal Docker/host rules: # Explicitly restrict traffic FROM AstrNet before normal Docker/host rules:
# BGP from the two expected neighbors, ping to this mesh ID; no transit. # BGP from the two expected neighbors, bounded ICMP to our mesh/transit
# addresses only; no service exposure or transit.
# Existing outbound sessions may receive established replies. # Existing outbound sessions may receive established replies.
systemd.services.astrnet-guard = { systemd.services.astrnet-guard = {
description = "Restrict AstrNet tunnel ingress"; description = "Restrict AstrNet tunnel ingress";
@ -69,7 +70,11 @@ in {
iifname "wg-mic-bd8" ip saddr 10.99.0.157 tcp dport 179 accept iifname "wg-mic-bd8" ip saddr 10.99.0.157 tcp dport 179 accept
iifname "wg-mic-der" ip6 saddr fd53:4023:2326:99::99 tcp dport 179 accept iifname "wg-mic-der" ip6 saddr fd53:4023:2326:99::99 tcp dport 179 accept
iifname "wg-mic-bd8" ip6 saddr fd53:4023:2326:99::9d tcp dport 179 accept iifname "wg-mic-bd8" ip6 saddr fd53:4023:2326:99::9d tcp dport 179 accept
iifname { "wg-mic-der", "wg-mic-bd8" } ip daddr 10.0.0.9 icmp type echo-request accept # Echo requests only from AstrNet sources, to THIS host's addresses.
iifname "wg-mic-der" ip saddr { 10.0.0.0/24, 10.99.0.0/22 } ip daddr { 10.0.0.9, 10.99.0.154 } icmp type echo-request accept
iifname "wg-mic-bd8" ip saddr { 10.0.0.0/24, 10.99.0.0/22 } ip daddr { 10.0.0.9, 10.99.0.158 } icmp type echo-request accept
iifname "wg-mic-der" ip6 saddr { 2a05:f480:2400:1cf7::/64, fd53:4023:2326::/48 } ip6 daddr { 2a05:f480:2400:1cf7::9, fd53:4023:2326:99::9a, fe80::2 } icmpv6 type echo-request accept
iifname "wg-mic-bd8" ip6 saddr { 2a05:f480:2400:1cf7::/64, fd53:4023:2326::/48 } ip6 daddr { 2a05:f480:2400:1cf7::9, fd53:4023:2326:99::9e, fe80::2 } icmpv6 type echo-request accept
iifname { "wg-mic-der", "wg-mic-bd8" } drop iifname { "wg-mic-der", "wg-mic-bd8" } drop
} }
chain forward { chain forward {