-{ config, pkgs, lib, ... }:
+{ lib, ... }:
{
-/*
-0.0.0.0/0 Default (can be advertised in BGP if desired)
-0.0.0.0/8 Self identification
-0.0.0.0/32 Broadcast
-10.0.0.0/8 Private Networks (RFC 1918)
-127.0.0.0/8 Loopback
-128.0.0.0/16 IANA Reserved (RFC 3330)
-172.16.0.0/12 Private Networks (RFC 1918)
-169.254.0.0/16 Local
-191.255.0.0/16 Reserved (RFC 3330)
-192.0.0.0/24 IANA Reserved (RFC 3330)
-192.0.2.0/24 Test-Net (RFC 3330)
-192.168.0.0/16 Networks (RFC 1918)
-198.18.0.0/15 Network Interconnect Device Benchmark Testing
-223.255.255.0/24 Special Use Networks (RFC 3330)
-224.0.0.0/4 Multicast
-240.0.0.0/4 Class E Reserved
-
-
-::/0 Default (can be advertised as a route in BGP to peers if desired)
-::/96 IPv4-compatible IPv6 address – deprecated by RFC4291
-::/128 Unspecified address
-::1 /128 Local host loopback address
-::ffff:0.0.0.0 /96 IPv4-mapped addresses
-::224.0.0.0 /100 Compatible address (IPv4 format)
-::127.0.0.0 /104 Compatible address (IPv4 format)
-::0.0.0.0 /104 Compatible address (IPv4 format)
-::255.0.0.0 /104 Compatible address (IPv4 format)
-0000:: /8 Pool used for unspecified, loopback and embedded IPv4 addresses
-0200:: /7 OSI NSAP-mapped prefix set (RFC4548) – deprecated by RFC4048
-3ffe::/16 Former 6bone, now decommissioned
-2001:db8::/32 Reserved by IANA for special purposes and documentation
-2002:e000:: /20 Invalid 6to4 packets (IPv4 multicast)
-2002:7f00:: /24 Invalid 6to4 packets (IPv4 loopback)
-2002:0000:: /24 Invalid 6to4 packets (IPv4 default)
-2002:ff00:: /24 Invalid 6to4 packets
-2002:0a00:: /24 Invalid 6to4 packets (IPv4 private 10.0.0.0/8 network)
-2002:ac10:: /28 Invalid 6to4 packets (IPv4 private 172.16.0.0/12 network)
-2002:c0a8:: /32 Invalid 6to4 packets (IPv4 private 192.168.0.0/16 network)
-fc00:: /7 Unicast Unique Local Addresses (ULA) – RFC 4193
-fe80:: /10 Link-local Unicast
-fec0:: /10 Site-local Unicast – deprecated by RFC 3879 (replaced by ULA)
-ff00:: /8 Multicast
-
-https://www.team-cymru.org/Services/Bogons/fullbogons-ipv6.txt
-*/
-networking.nftables.ruleset = lib.mkBefore (lib.readFile ./nftables.txt);
+ # TODO: https://www.team-cymru.org/Services/Bogons/fullbogons-ipv6.txt
+ networking.nftables = {
+ preCheckRuleset = ''
+ sed -i ruleset.conf \
+ -e 's/skuid *[^ ]*/skuid nobody/g' \
+ -e 's/skgid *[^ ]*/skgid nogroup/g'
+ '';
+ ruleset = lib.mkBefore (lib.readFile ./nftables.txt);
+ };
}