hosts/aubergine/networking/nftables.nix

   1 { config, ... }:
   2 let
   3   inherit (config.users) users;
   4 in
   5 {
   6   networking.firewall.enable = false;
   7   security.lockKernelModules = false;
   8   systemd.services.disable-kernel-module-loading.after = [ "nftables.service" ];
   9   # echo -e "$(nix eval hosts.aubergine.config.networking.nftables.ruleset)"
  10   # nft list ruleset
  11   networking.nftables = {
  12     enable = true;
  13     ruleset = ''
  14       table inet filter {
  15         chain input-lan {
  16           meta l4proto { udp, tcp } th dport domain counter accept comment "DNS"
  17           meta l4proto { udp, tcp } th dport bootps counter accept comment "DHCP"
  18           tcp dport ssh counter accept comment "SSH"
  19           udp dport 60000-61000 counter accept comment "Mosh"
  20           tcp dport 5201 counter accept comment "iperf"
  21         }
  22         chain input-net {
  23           jump check-public
  24         }
  25         chain input-intra {
  26           tcp dport ssh counter accept comment "SSH"
  27           udp dport 60000-61000 counter accept comment "Mosh"
  28           tcp dport 5201 counter accept comment "iperf"
  29         }
  30
  31         chain output-lan {
  32           tcp dport { ssh, 2222 } counter accept comment "SSH"
  33           counter accept
  34           tcp dport 5201 counter accept comment "iperf"
  35         }
  36         chain output-net {
  37           tcp dport { ssh, 2222 } counter accept comment "SSH"
  38           udp dport 60000-61000 counter accept comment "Mosh"
  39           tcp dport { http, https } counter accept comment "HTTP"
  40           udp dport ntp skuid ${users.systemd-timesync.name} counter accept comment "NTP"
  41           meta l4proto { udp, tcp } skuid dnscrypt-proxy2 counter accept comment "dnscrypt-proxy2"
  42           tcp dport git counter accept comment "Git"
  43           tcp dport 5201 counter accept comment "iperf"
  44         }
  45         chain output-intra {
  46           tcp dport { ssh, 2222 } counter accept comment "SSH"
  47           udp dport 60001-60010 counter accept comment "Mosh"
  48           tcp dport { http, https } counter accept comment "HTTP"
  49           tcp dport git counter accept comment "git"
  50           #tcp dport 4713 counter accept comment "pulseaudio"
  51           tcp dport 5201 counter accept comment "iperf"
  52         }
  53       }
  54     '';
  55   };
  56 }