From 315d1316c3c6482215433af047a2f1fd6731cea9 Mon Sep 17 00:00:00 2001 From: hausgeist Date: Sun, 27 Sep 2026 19:04:37 -0700 Subject: [PATCH] =?UTF-8?q?asusmini:=20open=205555/5556/6555/3030=20via=20?= =?UTF-8?q?allowedTCPPorts=20(extraInputRules=20was=20nft-backend-only,=20?= =?UTF-8?q?no-op=20on=20iptables=20backend=20=E2=80=94=20PR=20#1=20did=20n?= =?UTF-8?q?ot=20open=20the=20ports)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- hosts/asusmini/default.nix | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/hosts/asusmini/default.nix b/hosts/asusmini/default.nix index 0a34b5f..5da03d2 100644 --- a/hosts/asusmini/default.nix +++ b/hosts/asusmini/default.nix @@ -96,14 +96,14 @@ }; # Open ports in the firewall. - networking.firewall.allowedTCPPorts = [ 22 80 443 ]; - # Allow the CC edge (Caddy LXC on pve, 192.168.1.11) + LAN to reach the - # service ports directly; the public entry point moves off this box to - # 205.250.24.44 -> pve Caddy (see cc-ansible wiki / onboard plan). + # NOTE (2026-09-28): extraInputRules is nftables-backend-only and this box + # runs the default iptables backend — the src-scoped rule from PR #1 was a + # silent no-op (verified: ports stayed blocked from LAN after rebuild). + # allowedTCPPorts is backend-agnostic. Source-scoping is unnecessary now: + # the public forwards move off this box (205.250.24.44 -> pve Caddy LXC + # .1.11), leaving LAN (Z_DMZ) + tailnet as the only ingress paths. # Tailnet traffic already bypasses this (tailscale0 not restricted). - networking.firewall.extraInputRules = '' - ip saddr 192.168.1.0/24 tcp dport { 5555, 5556, 6555, 3030 } accept - ''; + networking.firewall.allowedTCPPorts = [ 22 80 443 5555 5556 6555 3030 ]; # networking.firewall.allowedUDPPorts = [ ... ]; # Or disable the firewall altogether. # networking.firewall.enable = false;