diff --git a/hosts/architect/firewall.nix b/hosts/architect/firewall.nix index b98a972..e592fe7 100644 --- a/hosts/architect/firewall.nix +++ b/hosts/architect/firewall.nix @@ -157,12 +157,11 @@ in { ip daddr 255.255.255.255 accept comment "allow broadcast traffic" ip daddr 224.0.0.0/4 accept comment "allow multicast traffic" ip saddr ${lan-net} accept comment "lan > local" + ip saddr ${tailscale-net} accept comment "tailscale > local" ip saddr {${lib.concatStringsSep "," gdevices-wg}} accept comment "vpn > local" iifname ${wan-if} tcp dport {${open_tcp_ports}} accept iifname ${wan-if} udp dport {${open_udp_ports}} accept - iifname ${tailscale-if} tcp dport {${open_tcp_ports_vpn}} accept - iifname ${tailscale-if} udp dport {${open_udp_ports_vpn}} accept iifname ${vpn-if} tcp dport {${open_tcp_ports_vpn}} accept iifname ${vpn-if} udp dport {${open_udp_ports_vpn}} accept iifname ${vpn-if} icmp type echo-request accept