From 6aa799c05de6b4936de53faef40025c4ff02c2ac Mon Sep 17 00:00:00 2001 From: Yuri Tatishchev Date: Sun, 11 Oct 2026 11:28:34 -0700 Subject: [PATCH] router: firewall: rule updates --- modules/router/firewall.nix | 1 + modules/router/ifconfig.nix | 3 +++ 2 files changed, 4 insertions(+) diff --git a/modules/router/firewall.nix b/modules/router/firewall.nix index 6de5a21..27b8674 100644 --- a/modules/router/firewall.nix +++ b/modules/router/firewall.nix @@ -58,6 +58,7 @@ in udp . 48425 : ${vars.extra.opnsense.addr4} . 48425, # Amnezia VPN server udp . 37138 : ${vars.extra.amnezia.addr4} . 37138, + tcp . 38247 : ${vars.extra.amnezia.addr4} . 22, # Minecruft server tcp . 25565 : ${vars.extra.minecruft.addr4} . 25565, udp . 25565 : ${vars.extra.minecruft.addr4} . 25565, diff --git a/modules/router/ifconfig.nix b/modules/router/ifconfig.nix index aa227b0..b5f3435 100644 --- a/modules/router/ifconfig.nix +++ b/modules/router/ifconfig.nix @@ -52,6 +52,9 @@ in # since my WAN and LAN20 are technically bridged. # https://networkengineering.stackexchange.com/questions/83071/why-linux-answers-arp-requests-for-ips-that-belong-to-different-network-interfac boot.kernel.sysctl."net.ipv4.conf.default.arp_filter" = 1; + # Later I discovered that rp_filter might also be good to set + # Strict mode (1) drops packets if the src ip isn't a local route on the interface + boot.kernel.sysctl."net.ipv4.conf.default.rp_filter" = 1; # It is impossible to do multiple prefix requests with networkd, # so I use dhcpcd for this