aynish/commoncomputing-nix
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Activity

asusmini: open service ports via allowedTCPPorts (fix #1 — extraInputRules no-op on iptables backend) #2

Merged
aynish merged 1 commits from caddy-edge-iptables-backend into main 2026-09-28 04:20:17 +00:00
Conversation 1 Commits 1 Files Changed 1
+7 -7
boris commented 2026-09-28 02:04:39 +00:00
Collaborator
Copy Link
Copy Source

PR #1 was a silent no-op. networking.firewall.extraInputRules is nftables-backend-only; this box runs the default iptables backend (nft: command not found, no networking.nftables.enable), so the src-scoped nft rule never applied.

Verified after the merge+rebuild (gen 35, 2026-09-27): 5555/5556/6555/3030 still blocked from both LAN origins (.1.10 pve, .1.11 caddy LXC); only 80/443/22 open.

This PR: switch to backend-agnostic networking.firewall.allowedTCPPorts = [ 22 80 443 5555 5556 6555 3030 ]. Source-scoping is no longer needed: public forwards move off this box to 205.250.24.44 -> pve Caddy LXC (.1.11); remaining ingress is LAN (Z_DMZ) + tailnet only.

Apply: nixos-rebuild switch on asusmininix. Immediate alternative: sudo iptables -I INPUT -s 192.168.1.0/24 -p tcp -m multiport --dports 5555,5556,6555,3030 -j ACCEPT.

**PR #1 was a silent no-op.** `networking.firewall.extraInputRules` is nftables-backend-only; this box runs the default **iptables** backend (`nft: command not found`, no `networking.nftables.enable`), so the src-scoped nft rule never applied. Verified after the merge+rebuild (gen 35, 2026-09-27): 5555/5556/6555/3030 still blocked from both LAN origins (.1.10 pve, .1.11 caddy LXC); only 80/443/22 open. **This PR:** switch to backend-agnostic `networking.firewall.allowedTCPPorts = [ 22 80 443 5555 5556 6555 3030 ]`. Source-scoping is no longer needed: public forwards move off this box to 205.250.24.44 -> pve Caddy LXC (.1.11); remaining ingress is LAN (Z_DMZ) + tailnet only. Apply: `nixos-rebuild switch` on asusmininix. Immediate alternative: `sudo iptables -I INPUT -s 192.168.1.0/24 -p tcp -m multiport --dports 5555,5556,6555,3030 -j ACCEPT`.
boris added 1 commit 2026-09-28 02:04:40 +00:00
asusmini: open 5555/5556/6555/3030 via allowedTCPPorts (extraInputRules was nft-backend-only, no-op on iptables backend — PR #1 did not open the ports) 315d1316c3
aynish approved these changes 2026-09-28 04:18:51 +00:00
aynish merged commit 2bae941f4a into main 2026-09-28 04:20:17 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
aynish
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
boris (Boris Mann) aynish (Anish Lakhwara)
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: aynish/commoncomputing-nix#2