hosts/carbon: Don't send IPv4 to ppp tunnel

flake.lock

@@ -666,11 +666,11 @@
     },
     "nixpkgs_5": {
       "locked": {
-        "lastModified": 1763421233,
-        "narHash": "sha256-Stk9ZYRkGrnnpyJ4eqt9eQtdFWRRIvMxpNRf4sIegnw=",
+        "lastModified": 1761114652,
+        "narHash": "sha256-f/QCJM/YhrV/lavyCVz8iU3rlZun6d+dAiC3H+CDle4=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "89c2b2330e733d6cdb5eae7b899326930c2c0648",
+        "rev": "01f116e4df6a15f4ccdffb1bcd41096869fb385c",
         "type": "github"
       },
       "original": {

hosts/carbon/ppp-ncfttb.nix

@@ -60,4 +60,10 @@
     ip46tables -t mangle -A forward-mangle -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
   '';
 
+  networking.firewall.extraCommands = ''
+    # Reject all IPv4 traffic that tries to enter and leave the PPP tunnel
+    iptables -I INPUT -i ppp-ncfttb -j DROP
+    iptables -I OUTPUT -o ppp-ncfttb -j DROP
+  '';
+
 }

profiles/router/default.nix

@@ -11,8 +11,10 @@ with lib;
   config = mkIf config.profiles.clerie.router.enable {
 
     environment.systemPackages = with pkgs; [
-      wireguard-tools
+      conntrack-tools
+      iptstate # show conntrack table
       tcpdump
+      wireguard-tools
     ];
   
     boot.kernel.sysctl = {