feat(router): isolate subnets on firewall

deedee-ops · Jun 28, 2024 · f9a6066 · f9a6066
1 parent 467ed6d
commit f9a6066
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/nix/machines/router/modules/firewall.nix b/nix/machines/router/modules/firewall.nix
@@ -19,11 +19,12 @@
           type filter hook input priority filter; policy accept;
         }
         chain FORWARD {
-          type filter hook forward priority filter; policy accept;
+          type filter hook forward priority filter; policy drop;
           ct state related,established accept
           iifname "mgmt0" oifname "wan0" accept
           iifname "trst0" oifname "wan0" accept
           iifname "untrst0" oifname "wan0" accept
+          ip daddr 10.99.0.0/16 iifname "trst0" accept
         }
         chain OUTPUT {
           type filter hook output priority filter; policy accept;