node exporter: only accept packets from monitoringvpn

nixos/modules/monitoring/exporters/node.nix

@@ -17,6 +17,7 @@ in {
   config.services.prometheus.exporters.node = {
     enable = true;
     openFirewall = true;
+    firewallFilter = "-i monitoringvpn -p tcp -m tcp --dport 9100";
     port = 9100;
     # extraFlags = [ "--collector.disable-defaults" ]; # not in nixpkgs 19.09
     # Thanks https://github.com/mayflower/nixexprs/blob/master/modules/monitoring/default.nix