zuckerberg/nix-config
1
0
Fork 0
Code Issues Pull Requests Actions Activity

fix transmission port forwarding
All checks were successful
Check Flake / check-flake (push) Successful in 3m25s
Details

Browse Source
This commit is contained in:
Zuckerberg
2026-02-26 00:08:40 -08:00
parent 4eb0401263
commit 6466406975
3 changed files with 18 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
common/network/pia-vpn/default.nix
View File

@@ -51,10 +51,6 @@ let
receiveForwardedPort = mkOption {
type = types.nullOr (types.submodule {
options = {
port = mkOption {
type = types.port;
description = "Target port to forward PIA-assigned port to";
};
protocol = mkOption {
type = types.enum [ "tcp" "udp" "both" ];
default = "both";

23
common/network/pia-vpn/vpn-container.nix
View File

@@ -24,16 +24,15 @@ let
let
fwd = forwardingContainer.receiveForwardedPort;
targetIp = forwardingContainer.ip;
targetPort = toString fwd.port;
tcpRules = optionalString (fwd.protocol == "tcp" || fwd.protocol == "both") ''
echo "Setting up TCP DNAT: port $PORT → ${targetIp}:${targetPort}"
iptables -t nat -A PREROUTING -i ${cfg.interfaceName} -p tcp --dport $PORT -j DNAT --to ${targetIp}:${targetPort}
iptables -A FORWARD -i ${cfg.interfaceName} -d ${targetIp} -p tcp --dport ${targetPort} -j ACCEPT
echo "Setting up TCP DNAT: port $PORT → ${targetIp}:$PORT"
iptables -t nat -A PREROUTING -i ${cfg.interfaceName} -p tcp --dport $PORT -j DNAT --to ${targetIp}
iptables -A FORWARD -i ${cfg.interfaceName} -d ${targetIp} -p tcp --dport $PORT -j ACCEPT
'';
udpRules = optionalString (fwd.protocol == "udp" || fwd.protocol == "both") ''
echo "Setting up UDP DNAT: port $PORT → ${targetIp}:${targetPort}"
iptables -t nat -A PREROUTING -i ${cfg.interfaceName} -p udp --dport $PORT -j DNAT --to ${targetIp}:${targetPort}
iptables -A FORWARD -i ${cfg.interfaceName} -d ${targetIp} -p udp --dport ${targetPort} -j ACCEPT
echo "Setting up UDP DNAT: port $PORT → ${targetIp}:$PORT"
iptables -t nat -A PREROUTING -i ${cfg.interfaceName} -p udp --dport $PORT -j DNAT --to ${targetIp}
iptables -A FORWARD -i ${cfg.interfaceName} -d ${targetIp} -p udp --dport $PORT -j ACCEPT
'';
onPortForwarded = optionalString (forwardingContainer.onPortForwarded != null) ''
TARGET_IP="${targetIp}"
@@ -43,9 +42,13 @@ let
'';
in
''
${tcpRules}
${udpRules}
${onPortForwarded}
if [ "$PORT" -lt 1000 ]; then
echo "ERROR: PIA assigned privileged port $PORT (< 1000), refusing to set up DNAT" >&2
else
${tcpRules}
${udpRules}
${onPortForwarded}
fi
''
);
in