diff options
| author | Collin Williams <96917990+bluedragon1221@users.noreply.github.com> | 2026-02-27 13:39:26 -0600 |
|---|---|---|
| committer | Collin Williams <96917990+bluedragon1221@users.noreply.github.com> | 2026-02-27 13:39:26 -0600 |
| commit | e2cbadf78d857864b2bd2480980324a02093bb47 (patch) | |
| tree | ead235baba314898ae306033e38205172f29fb67 | |
| parent | d8f7401263a36cce780ed38efce8aaf86d85fd96 (diff) | |
killswitch exception for webui
| -rw-r--r-- | hosts/ganymede/nixos.nix | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/hosts/ganymede/nixos.nix b/hosts/ganymede/nixos.nix index c6d7bd1..373b0d2 100644 --- a/hosts/ganymede/nixos.nix +++ b/hosts/ganymede/nixos.nix @@ -62,11 +62,14 @@ networking.firewall.extraCommands = # bash '' - # Allow qbittorrent traffic over wg0 + # Allow qbittorrent to talk to itself (WebUI on 127.0.0.1) + iptables -A OUTPUT -o lo -m owner --uid-owner qbittorrent -j ACCEPT + + # Allow all qbittorrent traffic over WireGuard iptables -A OUTPUT -o wg0 -m owner --uid-owner qbittorrent -j ACCEPT - # Drop qbittorrent traffic over anything else - iptables -A OUTPUT ! -o wg0 -m owner --uid-owner qbittorrent -j REJECT + # Block everything else from qbittorrent user (kill switch) + iptables -A OUTPUT -m owner --uid-owner qbittorrent -j REJECT ''; services.fail2ban.enable = true; |