abonerib/bscpkgs
1
0
Fork 0
forked from rarias/bscpkgs
Code Pull Requests 1 Activity

Don't forward any docker traffic

Browse Source 
Access to the 23080 local port will be done by applying the INPUT rules,
which pass through nixos-fw.

Reviewed-by: Aleix Boné <abonerib@bsc.es>
This commit is contained in:
Rodrigo Arias 2025-04-15 12:46:08 +02:00
parent 93f8d3aa89
commit d0f151595f
1 changed files with 3 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
m/hut/gitlab-runner.nix
View File

@ -99,10 +99,9 @@
# DOCKER* chains are useless, override at FORWARD and nixos-fw # DOCKER* chains are useless, override at FORWARD and nixos-fw
networking.firewall.extraCommands = '' networking.firewall.extraCommands = ''
# Allow docker to use our proxy # Don't forward any traffic from docker
iptables -I FORWARD 1 -p tcp -i docker0 -d hut --dport 23080 -j nixos-fw-accept iptables -I FORWARD 1 -p all -i docker0 -j nixos-fw-log-refuse
# Block anything else coming from docker
iptables -I FORWARD 2 -p all -i docker0 -j nixos-fw-log-refuse
# Allow incoming traffic from docker to 23080 # Allow incoming traffic from docker to 23080
iptables -A nixos-fw -p tcp -i docker0 -d hut --dport 23080 -j ACCEPT iptables -A nixos-fw -p tcp -i docker0 -d hut --dport 23080 -j ACCEPT
''; '';