-{ pkgs, lib, config, hosts, ... }:
+{ config, ... }:
let
inherit (config.users) users;
in
{
-networking.firewall.enable = false;
-security.lockKernelModules = false;
-systemd.services.disable-kernel-module-loading.after = [ "nftables.service" ];
-# echo -e "$(nix eval hosts.aubergine.config.networking.nftables.ruleset)"
-# nft list ruleset
-networking.nftables = {
- enable = true;
- ruleset = lib.mkBefore ''
- table inet filter {
- include "${../../../nixos/profiles/nftables/filter.txt}"
- chain net2fw {
- jump check-public
- # Some .nix append rules here with: add rule inet filter net2fw ...
- }
- chain fw2net {
- tcp dport { 80, 443 } counter accept comment "HTTP"
- udp dport 123 skuid ${users.systemd-timesync.name} counter accept comment "NTP"
- meta l4proto { udp, tcp } skuid dnscrypt-proxy2 counter accept comment "dnscrypt-proxy2"
- tcp dport 9418 counter accept comment "Git"
- tcp dport ssh counter accept comment "SSH"
- udp dport 60001-60010 counter accept comment "Mosh"
-
- # Some .nix append rules here with: add rule inet filter fw2net ...
- }
- chain lan2fw {
- # Some .nix append rules here with: add rule inet filter lan2fw ...
- }
- chain fw2lan {
- accept
- # Some .nix append rules here with: add rule inet filter fw2lan ...
- }
-
- chain input {
- type filter hook input priority 0
- policy drop
-
- iifname lo accept
-
- jump check-tcp
- jump check-ping
- jump check-broadcast
-
- # accept traffic already established
- ct state { established, related } accept
- jump accept-connectivity-input
- ct state invalid counter drop
-
- # admin services
- tcp dport 22 counter accept comment "SSH"
- udp dport 60000-61000 counter accept comment "Mosh"
-
- # Some .nix append gotos here with: add rule inet filter input iffname ... goto ...
- }
- chain output {
- type filter hook output priority 0
- policy drop
-
- oifname lo accept
-
- tcp flags syn tcp option maxseg size set rt mtu
-
- ct state { established, related } accept
- jump accept-connectivity-output
-
- tcp dport 22 counter accept comment "SSH"
-
- # Some .nix append gotos here with: add rule inet filter output oifname ... goto ...
- }
- chain forward {
- type filter hook forward priority 0
- policy drop
- }
- }
- table inet nat {
- chain prerouting {
- type nat hook prerouting priority filter
- policy accept
- }
- chain postrouting {
- type nat hook postrouting priority srcnat
- policy accept
- }
- }
- '';
-};
+ networking.firewall.enable = false;
+ security.lockKernelModules = false;
+ systemd.services.disable-kernel-module-loading.after = [ "nftables.service" ];
+ # echo -e "$(nix eval hosts.aubergine.config.networking.nftables.ruleset)"
+ # nft list ruleset
+ networking.nftables = {
+ enable = true;
+ preCheckRuleset = ''
+ sed -i ruleset.conf \
+ -e 's/ip daddr losurdo.wg//'
+ '';
+ ruleset = ''
+ table inet filter {
+ chain input-intra {
+ tcp dport { ssh, 2222 } counter accept comment "SSH"
+ udp dport 60001-60010 counter accept comment "Mosh"
+ #tcp dport 4713 counter accept comment "pulseaudio"
+ tcp dport 5201 counter accept comment "iperf"
+ }
+ chain input-net {
+ }
+
+ chain output-lan {
+ tcp dport { ssh, 2222 } counter accept comment "SSH"
+ udp dport 60001-60100 counter accept comment "Mosh"
+ tcp dport bootps counter accept comment "DHCP"
+ tcp dport { 4444, 5555 } counter accept
+ tcp dport 5201 counter accept comment "iperf"
+ }
+ chain output-intra {
+ tcp dport { ssh, 2222 } counter accept comment "SSH"
+ udp dport 60001-60100 counter accept comment "Mosh"
+ tcp dport { http, https } counter accept comment "HTTP"
+ tcp dport git counter accept comment "Git"
+ tcp dport 5201 counter accept comment "iperf"
+ ip daddr losurdo.wg tcp dport 9091 counter accept comment "transmission"
+ }
+ chain output-net {
+ tcp dport { ssh, 2222, 20022 } counter accept comment "SSH"
+ udp dport 60001-60100 counter accept comment "Mosh"
+ udp dport ntp skuid ${users.systemd-timesync.name} counter accept comment "NTP"
+ meta l4proto { udp, tcp } skuid dnscrypt-proxy2 counter accept comment "dnscrypt-proxy2"
+ tcp dport { http, https } counter accept comment "HTTP"
+ tcp dport git counter accept comment "Git"
+ tcp dport imaps counter accept comment "IMAPS"
+ tcp dport submissions counter accept comment "SMTPS"
+ tcp dport xmpp-client counter accept comment "XMPP client"
+ tcp dport 5223 counter accept comment "XMPP client direct TLS"
+ tcp dport 5281 counter accept comment "XMPP HTTPS"
+ tcp dport nntps counter accept comment "NNTPS"
+ tcp dport 5201 counter accept comment "iperf"
+ }
+ }
+ '';
+ };
}