3 inherit (config.users) users;
6 networking.firewall.enable = false;
7 security.lockKernelModules = false;
8 systemd.services.disable-kernel-module-loading.after = [ "nftables.service" ];
9 # echo -e "$(nix eval hosts.aubergine.config.networking.nftables.ruleset)"
11 networking.nftables = {
15 -e 's/ip daddr losurdo.wg//'
20 tcp dport { ssh, 2222 } counter accept comment "SSH"
21 udp dport 60001-60010 counter accept comment "Mosh"
22 #tcp dport 4713 counter accept comment "pulseaudio"
23 tcp dport 5201 counter accept comment "iperf"
29 tcp dport { http, https } counter accept comment "HTTP(s)"
30 tcp dport { ssh, 2222 } counter accept comment "SSH"
31 udp dport 60001-60100 counter accept comment "Mosh"
32 tcp dport bootps counter accept comment "DHCP"
33 tcp dport { 4444, 5555 } counter accept
34 tcp dport 5201 counter accept comment "iperf"
37 tcp dport { ssh, 2222 } counter accept comment "SSH"
38 udp dport 60001-60100 counter accept comment "Mosh"
39 tcp dport { http, https } counter accept comment "HTTP"
40 tcp dport git counter accept comment "Git"
41 tcp dport 5201 counter accept comment "iperf"
42 ip daddr losurdo.wg tcp dport 9091 counter accept comment "transmission"
45 tcp dport { ssh, 2222, 20022 } counter accept comment "SSH"
46 udp dport 60001-60100 counter accept comment "Mosh"
47 udp dport ntp skuid ${users.systemd-timesync.name} counter accept comment "NTP"
48 meta l4proto { udp, tcp } skuid dnscrypt-proxy2 counter accept comment "dnscrypt-proxy2"
49 tcp dport { http, https } counter accept comment "HTTP"
50 tcp dport git counter accept comment "Git"
51 tcp dport imaps counter accept comment "IMAPS"
52 tcp dport submissions counter accept comment "SMTPS"
53 tcp dport xmpp-client counter accept comment "XMPP client"
54 tcp dport 5223 counter accept comment "XMPP client direct TLS"
55 tcp dport 5281 counter accept comment "XMPP HTTPS"
56 tcp dport nntps counter accept comment "NNTPS"
57 tcp dport 5201 counter accept comment "iperf"