]> Git — Sourcephile - julm/julm-nix.git/blob - hosts/aubergine/networking/nftables.nix
julm: losurdo: install wine
[julm/julm-nix.git] / hosts / aubergine / networking / nftables.nix
1 { config, ... }:
2 let
3 inherit (config.users) users;
4 in
5 {
6 networking.firewall.enable = false;
7 security.lockKernelModules = false;
8 systemd.services.disable-kernel-module-loading.after = [ "nftables.service" ];
9 # echo -e "$(nix eval hosts.aubergine.config.networking.nftables.ruleset)"
10 # nft list ruleset
11 networking.nftables = {
12 enable = true;
13 ruleset = ''
14 table inet filter {
15 chain input-lan {
16 meta l4proto { udp, tcp } th dport domain counter accept comment "DNS"
17 meta l4proto { udp, tcp } th dport bootps counter accept comment "DHCP"
18 tcp dport ssh counter accept comment "SSH"
19 udp dport 60000-61000 counter accept comment "Mosh"
20 tcp dport 5201 counter accept comment "iperf"
21 }
22 chain input-net {
23 jump check-public
24 }
25 chain input-intra {
26 tcp dport ssh counter accept comment "SSH"
27 udp dport 60000-61000 counter accept comment "Mosh"
28 tcp dport 5201 counter accept comment "iperf"
29 }
30
31 chain output-lan {
32 tcp dport { ssh, 2222 } counter accept comment "SSH"
33 counter accept
34 tcp dport 5201 counter accept comment "iperf"
35 }
36 chain output-net {
37 tcp dport { ssh, 2222 } counter accept comment "SSH"
38 udp dport 60000-61000 counter accept comment "Mosh"
39 tcp dport { http, https } counter accept comment "HTTP"
40 udp dport ntp skuid ${users.systemd-timesync.name} counter accept comment "NTP"
41 meta l4proto { udp, tcp } skuid dnscrypt-proxy2 counter accept comment "dnscrypt-proxy2"
42 tcp dport git counter accept comment "Git"
43 tcp dport 5201 counter accept comment "iperf"
44 }
45 chain output-intra {
46 tcp dport { ssh, 2222 } counter accept comment "SSH"
47 udp dport 60001-60010 counter accept comment "Mosh"
48 tcp dport { http, https } counter accept comment "HTTP"
49 tcp dport git counter accept comment "git"
50 #tcp dport 4713 counter accept comment "pulseaudio"
51 tcp dport 5201 counter accept comment "iperf"
52 }
53 }
54 '';
55 };
56 }