From 70ad63ca56fbfe78b044a1cc7866b35fdb822387 Mon Sep 17 00:00:00 2001
From: Sebastien Bourdeauducq <sb@m-labs.hk>
Date: Thu, 23 Jun 2022 15:33:37 +0800
Subject: [PATCH] nixbld: block internet access on insecure device

---
 nixbld-etc-nixos/configuration.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/nixbld-etc-nixos/configuration.nix b/nixbld-etc-nixos/configuration.nix
index c99c7a60..11394a98 100644
--- a/nixbld-etc-nixos/configuration.nix
+++ b/nixbld-etc-nixos/configuration.nix
@@ -114,11 +114,19 @@ in
         iptables -w -A block-lan-from-wifi -i ${netifLan} -o ${netifWifi} -j DROP
         iptables -w -A block-lan-from-wifi -i ${netifWifi} -o ${netifLan} -j DROP
         iptables -w -A FORWARD -j block-lan-from-wifi
+
+        iptables -w -N block-insecure-devices
+        iptables -w -A block-insecure-devices -m mac --mac-source 00:20:0c:6c:ee:ba -j DROP
+        iptables -w -A FORWARD -j block-insecure-devices
       '';
       extraStopCommands = ''
         iptables -w -D FORWARD -j block-lan-from-wifi 2>/dev/null|| true
         iptables -w -F block-lan-from-wifi 2>/dev/null|| true
         iptables -w -X block-lan-from-wifi 2>/dev/null|| true
+
+        iptables -w -D FORWARD -j block-insecure-devices 2>/dev/null|| true
+        iptables -w -F block-insecure-devices 2>/dev/null|| true
+        iptables -w -X block-insecure-devices 2>/dev/null|| true
       '';
     };
     sits."${netifSit}" = {