nix: cleaner fileset

[julm/julm-nix.git] / hosts / courge / networking / nftables.nix

diff --git a/hosts/courge/networking/nftables.nix b/hosts/courge/networking/nftables.nix
index 9dc81c31044f8c7e3db6c1d528a133234f1dc657..869c5c79d14261b3145142d76c1b1851be0623af 100644 (file)
--- a/hosts/courge/networking/nftables.nix
+++ b/hosts/courge/networking/nftables.nix
@@ -21,31 +21,33 @@ in
         chain input-intra {
           tcp dport { ssh, 2222 } counter accept comment "SSH"
           udp dport 60001-60010 counter accept comment "Mosh"
-          #tcp dport 4713 counter accept comment "pulseaudio"
           tcp dport 5201 counter accept comment "iperf"
         }
+        chain input-lan {
+          tcp dport { ssh, 2222 } counter accept comment "SSH"
+          udp dport 60001-60010 counter accept comment "Mosh"
+        }
         chain input-net {
         }
 
-        chain output-lan {
+        chain output-intra {
           tcp dport { ssh, 2222 } counter accept comment "SSH"
           udp dport 60001-60100 counter accept comment "Mosh"
-          tcp dport bootps counter accept comment "DHCP"
-          tcp dport { 4444, 5555 } counter accept
+          tcp dport { http, https } counter accept comment "HTTP"
+          tcp dport git counter accept comment "Git"
           tcp dport 5201 counter accept comment "iperf"
         }
-        chain output-intra {
+        chain output-lan {
           tcp dport { ssh, 2222 } counter accept comment "SSH"
           udp dport 60001-60100 counter accept comment "Mosh"
-          tcp dport { http, https } counter accept comment "HTTP"
-          tcp dport git counter accept comment "Git"
+          tcp dport bootps counter accept comment "DHCP"
+          tcp dport { 4444, 5555 } counter accept
           tcp dport 5201 counter accept comment "iperf"
         }
         chain output-net {
           tcp dport { ssh, 2222, 20022 } counter accept comment "SSH"
           udp dport 60001-60100 counter accept comment "Mosh"
           udp dport ntp skuid ${users.systemd-timesync.name} counter accept comment "NTP"
-          meta l4proto { udp, tcp } skuid dnscrypt-proxy2 counter accept comment "dnscrypt-proxy2"
           tcp dport { http, https } counter accept comment "HTTP"
           tcp dport git counter accept comment "Git"
           tcp dport imaps counter accept comment "IMAPS"