aynish/commoncomputing-nix
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Activity

asusmini: open 5555/5556/6555/3030 via allowedTCPPorts (extraInputRules was nft-backend-only, no-op on iptables backend — PR #1 did not open the ports)

Browse Source
This commit is contained in:
hausgeist
2026-09-27 19:04:37 -07:00
parent 4ab392bc45
commit 315d1316c3
1 changed files with 7 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hosts/asusmini/default.nix
+7 -7
View File
@@ -96,14 +96,14 @@
}; };
# Open ports in the firewall. # Open ports in the firewall.
networking.firewall.allowedTCPPorts = [ 22 80 443 ]; # NOTE (2026-09-28): extraInputRules is nftables-backend-only and this box
# Allow the CC edge (Caddy LXC on pve, 192.168.1.11) + LAN to reach the # runs the default iptables backend — the src-scoped rule from PR #1 was a
# service ports directly; the public entry point moves off this box to # silent no-op (verified: ports stayed blocked from LAN after rebuild).
# 205.250.24.44 -> pve Caddy (see cc-ansible wiki / onboard plan). # allowedTCPPorts is backend-agnostic. Source-scoping is unnecessary now:
# the public forwards move off this box (205.250.24.44 -> pve Caddy LXC
# .1.11), leaving LAN (Z_DMZ) + tailnet as the only ingress paths.
# Tailnet traffic already bypasses this (tailscale0 not restricted). # Tailnet traffic already bypasses this (tailscale0 not restricted).
networking.firewall.extraInputRules = '' networking.firewall.allowedTCPPorts = [ 22 80 443 5555 5556 6555 3030 ];
ip saddr 192.168.1.0/24 tcp dport { 5555, 5556, 6555, 3030 } accept
'';
# networking.firewall.allowedUDPPorts = [ ... ]; # networking.firewall.allowedUDPPorts = [ ... ];
# Or disable the firewall altogether. # Or disable the firewall altogether.
# networking.firewall.enable = false; # networking.firewall.enable = false;