diff options
| -rw-r--r-- | home/root/arrakis.nix | 3 | ||||
| -rw-r--r-- | hosts/arrakis/default.nix | 17 |
2 files changed, 3 insertions, 17 deletions
diff --git a/home/root/arrakis.nix b/home/root/arrakis.nix index 32b7162..ea918fe 100644 --- a/home/root/arrakis.nix +++ b/home/root/arrakis.nix @@ -82,7 +82,8 @@ function start_vpn { - ip netns add vpn + ip netns add vpn + ip netns exec vpn ip link set lo up ip link add veth.host type veth peer veth.vpn ip link set dev veth.host up ip link set veth.vpn netns vpn up diff --git a/hosts/arrakis/default.nix b/hosts/arrakis/default.nix index b647b31..d44610b 100644 --- a/hosts/arrakis/default.nix +++ b/hosts/arrakis/default.nix @@ -68,22 +68,7 @@ chain output { type filter hook output priority filter; policy drop; - - # explicitly allow my DNS traffic without VPN - skuid nipsy ip daddr 192.168.1.1 tcp dport domain accept - skuid nipsy ip daddr 192.168.1.1 udp dport domain accept - - # explicitly allow my traffic without VPN - oifname veth.vpn skuid nipsy tcp sport 8080 accept # qBittorrent - oifname veth.vpn skuid nipsy tcp sport 9696 accept # Prowlarr - oifname veth.vpn skuid nipsy ip daddr 192.168.1.2 tcp dport { 7878, 8686, 8787, 8989 } accept # Prowlarr to { Radarr, Lidarr, Readarr, Sonarr } - oif lo skuid nipsy ip daddr 192.168.1.3 tcp dport 8080 accept # Prowlarr to qBittorrent - - # allow any traffic out through VPN - oifname wg1 accept - - # drop everything else - counter drop + counter accept } chain forward { |