From 1eb26d4140323bf7505a1782c3b8695c264b64da Mon Sep 17 00:00:00 2001
From: r-vdp <ramses@well-founded.dev>
Date: Thu, 4 Apr 2024 13:07:52 +0200
Subject: [PATCH] nixos/firewall-nftables: allow adding additional rules to the
 rpfilter chain

---
 .../services/networking/firewall-nftables.nix  | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/nixos/modules/services/networking/firewall-nftables.nix b/nixos/modules/services/networking/firewall-nftables.nix
index 7c7136cc96f1..40256906bdaa 100644
--- a/nixos/modules/services/networking/firewall-nftables.nix
+++ b/nixos/modules/services/networking/firewall-nftables.nix
@@ -45,6 +45,18 @@ in
           This option only works with the nftables based firewall.
         '';
       };
+
+      extraReversePathFilterRules = mkOption {
+        type = types.lines;
+        default = "";
+        example = "fib daddr . mark . iif type local accept";
+        description = lib.mdDoc ''
+          Additional nftables rules to be appended to the rpfilter-allow
+          chain.
+
+          This option only works with the nftables based firewall.
+        '';
+      };
     };
 
   };
@@ -79,6 +91,8 @@ in
             meta nfproto ipv4 udp sport . udp dport { 67 . 68, 68 . 67 } accept comment "DHCPv4 client/server"
             fib saddr . mark ${optionalString (cfg.checkReversePath != "loose") ". iif"} oif exists accept
 
+            jump rpfilter-allow
+
             ${optionalString cfg.logReversePathDrops ''
               log level info prefix "rpfilter drop: "
             ''}
@@ -86,6 +100,10 @@ in
           }
         ''}
 
+        chain rpfilter-allow {
+          ${cfg.extraReversePathFilterRules}
+        }
+
         chain input {
           type filter hook input priority filter; policy drop;