diff options
Diffstat (limited to 'hosts/ganymede')
| -rw-r--r-- | hosts/ganymede/nixos.nix | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/hosts/ganymede/nixos.nix b/hosts/ganymede/nixos.nix index c6d7bd1..373b0d2 100644 --- a/hosts/ganymede/nixos.nix +++ b/hosts/ganymede/nixos.nix @@ -62,11 +62,14 @@ networking.firewall.extraCommands = # bash '' - # Allow qbittorrent traffic over wg0 + # Allow qbittorrent to talk to itself (WebUI on 127.0.0.1) + iptables -A OUTPUT -o lo -m owner --uid-owner qbittorrent -j ACCEPT + + # Allow all qbittorrent traffic over WireGuard iptables -A OUTPUT -o wg0 -m owner --uid-owner qbittorrent -j ACCEPT - # Drop qbittorrent traffic over anything else - iptables -A OUTPUT ! -o wg0 -m owner --uid-owner qbittorrent -j REJECT + # Block everything else from qbittorrent user (kill switch) + iptables -A OUTPUT -m owner --uid-owner qbittorrent -j REJECT ''; services.fail2ban.enable = true; |