B4L/cnx-network-clan
5
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

router: allow SSH on the staging port

Browse Source 
The staging uplink is in no VLAN zone and was fully default-deny; admit
TCP 22 on it so the box is reachable from the old LAN before the mgmt
VLAN or the mesh are up. Everything else on the port stays closed.
This commit is contained in:
kurogeek
2026-09-16 08:30:14 +00:00
parent c9b04711c9
commit 4c589b8d0c
1 changed files with 15 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/clan/router/firewall.nix
+10 -3
View File
@@ -3,6 +3,7 @@
# other VLANs -> DNS/DHCP on the router + WAN (if allowWan); no inter-VLAN # other VLANs -> DNS/DHCP on the router + WAN (if allowWan); no inter-VLAN
# WAN (ppp0) -> nothing inbound beyond established/related # WAN (ppp0) -> nothing inbound beyond established/related
# mesh -> admin SSH + metrics scrapes (same trust boundary as the fleet) # mesh -> admin SSH + metrics scrapes (same trust boundary as the fleet)
# staging -> admin SSH only (pre-cutover uplink into the old LAN)
{ settings }: { settings }:
{ lib, ... }: { lib, ... }:
let let
@@ -26,14 +27,20 @@ in
filterForward = true; filterForward = true;
trustedInterfaces = [ "vlan-mgmt" ]; trustedInterfaces = [ "vlan-mgmt" ];
# Non-mgmt VLANs may only talk to the router's DNS and DHCP. # Non-mgmt VLANs may only talk to the router's DNS and DHCP; the staging
interfaces = lib.genAttrs nonMgmtIfs (_: { # uplink (old LAN, pre-cutover) gets admin SSH so the box can be reached
# before the mgmt VLAN or the mesh are up.
interfaces =
lib.genAttrs nonMgmtIfs (_: {
allowedTCPPorts = [ 53 ]; allowedTCPPorts = [ 53 ];
allowedUDPPorts = [ allowedUDPPorts = [
53 53
67 67
]; ];
}); })
// lib.optionalAttrs (cfg.stagingPort != null) {
${cfg.stagingPort}.allowedTCPPorts = [ 22 ];
};
extraInputRules = '' extraInputRules = ''
ip6 saddr ${cfg.mesh.subnet} tcp dport 22 accept comment "admin ssh over the mesh" ip6 saddr ${cfg.mesh.subnet} tcp dport 22 accept comment "admin ssh over the mesh"