nftables: polish

diff --git a/hosts/aubergine/networking.nix b/hosts/aubergine/networking.nix
index ed1f7ce8060f727a167828d1040d31f494536a5d..843372515abd7e06efeb3df150c1071053d57dce 100644 (file)
--- a/hosts/aubergine/networking.nix
+++ b/hosts/aubergine/networking.nix
@@ -199,7 +199,7 @@ environment.systemPackages = [
   pkgs.modem-manager-gui
 ];
 
-# iw dev wlp4s0 station dump
+# iw dev wlp5s0 station dump
 # DOC: https://w1.fi/cgit/hostap/plain/hostapd/hostapd.conf
 services.hostapd = {
   enable = true;

diff --git a/hosts/oignon/networking/nftables.nix b/hosts/oignon/networking/nftables.nix
index 18957b5df4d1ee42b06ce986fe7772c32c829a61..98c3c7ac2c0d00ce0753e8aa65497aaf6aca39a9 100644 (file)
--- a/hosts/oignon/networking/nftables.nix
+++ b/hosts/oignon/networking/nftables.nix
@@ -14,24 +14,26 @@ networking.nftables = {
     table inet filter {
       chain input-intra {
         tcp dport { ssh, 2222 } counter accept comment "SSH"
-        udp dport 60000-61000 counter accept comment "Mosh"
+        udp dport 60001-60010 counter accept comment "Mosh"
       }
       chain input-net {
       }
 
       chain output-lan {
         tcp dport { ssh, 2222 } counter accept comment "SSH"
+        udp dport 60001-60100 counter accept comment "Mosh"
         tcp dport bootps counter accept comment "DHCP"
+        tcp dport { 4444, 5555 } counter accept
       }
       chain output-intra {
         tcp dport { ssh, 2222 } counter accept comment "SSH"
-        udp dport 60001-60010 counter accept comment "Mosh"
+        udp dport 60001-60100 counter accept comment "Mosh"
         tcp dport { http, https } counter accept comment "HTTP"
         tcp dport git counter accept comment "Git"
       }
       chain output-net {
         tcp dport { ssh, 2222 } counter accept comment "SSH"
-        udp dport 60001-60010 counter accept comment "Mosh"
+        udp dport 60001-60100 counter accept comment "Mosh"
         udp dport ntp skuid ${users.systemd-timesync.name} counter accept comment "NTP"
         meta l4proto { udp, tcp } skuid dnscrypt-proxy2 counter accept comment "dnscrypt-proxy2"
         tcp dport { http, https } counter accept comment "HTTP"

diff --git a/nixos/profiles/networking.nix b/nixos/profiles/networking.nix
index cbff6a10cef178cad224372a8057de90e720fe3a..2dee8af207c82ebdbbe3fb8b9145f63ea20ac223 100644 (file)
--- a/nixos/profiles/networking.nix
+++ b/nixos/profiles/networking.nix
@@ -39,13 +39,13 @@ services.avahi = {
 networking.nftables.ruleset = lib.mkIf config.services.avahi.enable (''
   table inet filter {
     chain output-lan {
-      skuid root udp sport 5353 udp dport 5353 comment "Avahi"
+      skuid root udp sport mdns udp dport mdns comment "avahi: multicast DNS"
     }
   }
 '' + lib.optionalString config.services.avahi.openFirewall ''
   table inet filter {
     chain input-lan {
-      udp dport 5353 comment "Avahi"
+      udp dport mdns comment "avahi: multicast DNS"
     }
   }
 '');

diff --git a/nixos/profiles/networking/nftables.txt b/nixos/profiles/networking/nftables.txt
index 4ab07383c817f0caeba024b3187d2732de160830..8d2be5a7507c3f335b8618a4b26a349fd3ec39d8 100644 (file)
--- a/nixos/profiles/networking/nftables.txt
+++ b/nixos/profiles/networking/nftables.txt
@@ -177,7 +177,7 @@ table inet filter {
 
   chain output-connectivity {
     ip protocol icmp counter accept
-    meta skuid 0 udp dport 33434-33523 counter accept comment "traceroute"
+    skuid root udp dport 33434-33523 counter accept comment "traceroute"
 
     meta nfproto ipv6 meta l4proto ipv6-icmp jump accept-icmpv6
 

diff --git a/nixos/profiles/wireguard/wg-intra.nix b/nixos/profiles/wireguard/wg-intra.nix
index 6686dea75fc0048325ea1b0380ee7b17b11aebe9..bbb9ee6ad05c81e0cf4f22a354061b710731782b 100644 (file)
--- a/nixos/profiles/wireguard/wg-intra.nix
+++ b/nixos/profiles/wireguard/wg-intra.nix
@@ -1,18 +1,18 @@
 { pkgs, lib, config, hostName, credentials, ... }:
 let
-  iface = "wg-intra";
+  wgIface = "wg-intra";
   peers = import wg-intra/peers.nix;
-  wg = config.networking.wireguard.interfaces.${iface};
+  wg = config.networking.wireguard.interfaces.${wgIface};
 in
 {
 # Each peer select the other peers allowed to connect to it
-options.networking.wireguard.${iface}.peers =
+options.networking.wireguard.${wgIface}.peers =
   lib.genAttrs (lib.attrNames peers) (peerName: {
     enable = lib.mkEnableOption "this peer";
   });
 config = {
-systemd.services."wireguard-${iface}".serviceConfig.LoadCredentialEncrypted = "privateKey:${credentials}/wireguard/${iface}/privateKey.secret";
-networking.wireguard.interfaces.${iface} = lib.recursiveUpdate
+systemd.services."wireguard-${wgIface}".serviceConfig.LoadCredentialEncrypted = "privateKey:${credentials}/wireguard/${wgIface}/privateKey.secret";
+networking.wireguard.interfaces.${wgIface} = lib.recursiveUpdate
   (removeAttrs peers.${hostName} ["ipv4" "persistentKeepalive" "peer"])
   {
     peers =
@@ -26,7 +26,7 @@ networking.wireguard.interfaces.${iface} = lib.recursiveUpdate
           }
           peer.peer)
         (removeAttrs
-          (lib.filterAttrs (peerName: _: config.networking.wireguard.${iface}.peers.${peerName}.enable) peers)
+          (lib.filterAttrs (peerName: _: config.networking.wireguard.${wgIface}.peers.${peerName}.enable) peers)
           [hostName]);
     privateKeyFile = "$CREDENTIALS_DIRECTORY/privateKey";
 
@@ -35,7 +35,7 @@ networking.wireguard.interfaces.${iface} = lib.recursiveUpdate
     # This prevents connections to stall on huge packets,
     # or delaying their initializing due to TCP PMTU probing.
     postSetup = ''
-      ip link set dev ${iface} mtu 1280
+      ip link set dev ${wgIface} mtu 1280
     '';
   };
 networking.hosts = lib.mkMerge [
@@ -56,42 +56,42 @@ networking.firewall.extraCommands = lib.optionalString (wg.listenPort != null) '
 networking.nftables.ruleset = lib.optionalString (wg.listenPort != null) ''
   table inet filter {
     chain input-lan {
-      udp dport ${toString wg.listenPort} counter accept comment "Wireguard ${iface} input from peers"
+      udp dport ${toString wg.listenPort} counter accept comment "Wireguard ${wgIface} input from peers"
     }
     chain input-net {
-      udp dport ${toString wg.listenPort} counter accept comment "Wireguard ${iface} input from peers"
+      udp dport ${toString wg.listenPort} counter accept comment "Wireguard ${wgIface} input from peers"
     }
     chain input-intra {
       ${lib.optionalString (peers.${hostName}.peer.endpointsUpdater.enable or false) ''
-        tcp dport ${toString peers.${hostName}.listenPort} ip daddr ${peers.${hostName}.ipv4} counter accept comment "Wireguard ${iface} from peers to endpointUpdater"
+        tcp dport ${toString peers.${hostName}.listenPort} ip daddr ${peers.${hostName}.ipv4} counter accept comment "Wireguard ${wgIface} from peers to endpointUpdater"
         ''
       }
     }
     chain input {
-      iifname ${iface} jump input-intra
-      iifname ${iface} log level warn prefix "input-intra: " counter drop
+      iifname ${wgIface} jump input-intra
+      iifname ${wgIface} log level warn prefix "input-intra: " counter drop
     }
 
     chain output-lan {
-      udp sport ${toString wg.listenPort} counter accept comment "Wireguard ${iface} output to peers"
+      udp sport ${toString wg.listenPort} counter accept comment "Wireguard ${wgIface} output to peers"
     }
     chain output-net {
-      udp sport ${toString wg.listenPort} counter accept comment "Wireguard ${iface} output to peers"
+      udp sport ${toString wg.listenPort} counter accept comment "Wireguard ${wgIface} output to peers"
     }
     chain output-intra {
       ${lib.concatStringsSep "\n"
           (lib.mapAttrsToList (peerName: peer: ''
-            tcp dport ${toString peer.listenPort} ip daddr ${peer.ipv4} counter accept comment "Wireguard ${iface} to endpointUpdater ${peerName}"
+            tcp dport ${toString peer.listenPort} ip daddr ${peer.ipv4} counter accept comment "Wireguard ${wgIface} to endpointUpdater ${peerName}"
             '')
             (lib.filterAttrs (peerName: peer:
-              config.networking.wireguard.${iface}.peers.${peerName}.enable &&
+              config.networking.wireguard.${wgIface}.peers.${peerName}.enable &&
               (peers.${peerName}.peer.endpointsUpdater.enable or false))
               peers))
       }
     }
     chain output {
-      oifname ${iface} jump output-intra
-      oifname ${iface} log level warn prefix "output-intra: " counter drop
+      oifname ${wgIface} jump output-intra
+      oifname ${wgIface} log level warn prefix "output-intra: " counter drop
     }
   }
 '';
@@ -99,6 +99,7 @@ networking.nftables.ruleset = lib.optionalString (wg.listenPort != null) ''
 services.fail2ban.ignoreIP = lib.concatMap
   (host: host.peer.allowedIPs)
   (lib.attrValues peers);
-networking.networkmanager.unmanaged = ["wg-intra"];
+networking.networkmanager.unmanaged = [ wgIface ];
+systemd.services.sshd.after = ["wireguard-${wgIface}.service"];
 };
 }