| 7 Feb 2026 |
 K900 | Hmm you know what actually | 19:16:33 |
| K900 | networking.firewall.filterForward is a thing | 19:16:39 |
| K900 | And does basically just enough and just stupid enough for me to enable it | 19:16:47 |
 Albert Larsan | I think it would break my dn42 stuff though | 19:17:19 |
| K900 | Hmm actually this kinda sucks now | 19:19:59 |
| K900 | I guess I need miniupnpd | 19:20:32 |
| K900 | OK so | 22:04:10 |
| K900 | I fell down a fucking hole again | 22:04:13 |
| K900 | Our miniupnpd can't do IPv6 pinholing | 22:04:31 |
| K900 | This enables it in just the package; https://github.com/NixOS/nixpkgs/pull/488104 | 22:04:40 |
| K900 | Which is basically a no-op because it can't make anything worse | 22:04:47 |
| K900 | However, right now our firewall basically does ct status dnat accept | 22:05:44 |
| K900 | Which works for v4 because there is NAT | 22:05:49 |
| K900 | But not for v6, because pinholing is not NAT | 22:05:55 |
| K900 | And the miniupnpd chain is never actually hit | 22:06:04 |
| K900 | So uhhh | 22:06:13 |
| K900 | Thoughts | 22:06:14 |
 raitobezarius | not deeply familiar with pinholing but doesn't it have any conntrack correspondance? | 22:15:06 |
| K900 | Nope | 22:16:34 |
| K900 | It's basically just adding a rule for "ip daddr ... tcp dport ... accept" | 22:17:06 |
| K900 | You do it on the global IPv6 | 22:17:35 |
| K900 | So the default is to not forward anything into the LAN but a client can ask nicely | 22:17:47 |
| raitobezarius | so if this thing dynamically add a ip daddr X tcp dport Y accept, aren't you just missing ip6_forwarding=1 ? | 22:19:29 |
| K900 | The problem is that it's adding it to its own chain | 22:19:51 |
| K900 | That is not hooked up to anything | 22:19:55 |
| K900 | And right now our normal firewall doesn't know it exists | 22:20:10 |
| raitobezarius | so why not jump to that chain inside your main filter table? | 22:20:15 |
| K900 | That's what I'm currently doing, but the nixos module sets it up as another table entirely | 22:20:34 |
| K900 | So you can't even jump to it from the normal filter rules | 22:20:50 |
| raitobezarius | i don't think it makes a lot of sense | 22:21:47 |
