1 { pkgs, lib, config, servers, ... }:
3 inherit (builtins) hasAttr readFile;
4 inherit (pkgs.lib) unlinesAttrs;
5 inherit (config.users) users groups;
8 networking.firewall.enable = false;
9 security.lockKernelModules = false;
10 systemd.services.disable-kernel-module-loading.after = [ "nftables.service" ];
11 # echo -e "$(nix eval servers.losurdo.config.networking.nftables.ruleset)"
13 networking.nftables = {
15 ruleset = lib.mkBefore ''
18 udp dport 53 counter accept comment "DNS"
19 # Some .nix append rules here with: add rule inet filter net2fw ...
22 udp dport 53 counter accept comment "DNS"
23 tcp dport {80,443} counter accept comment "HTTP"
24 udp dport 123 skuid ${users.systemd-timesync.name} counter accept comment "NTP"
25 tcp dport 9418 counter accept comment "Git"
27 # Some .nix append rules here with: add rule inet filter fw2net ...
31 type filter hook input priority 0
36 # accept traffic already established
37 ct state {established, related} accept
41 tcp dport 22 counter accept comment "SSH"
42 udp dport 60000-61000 counter accept comment "Mosh"
45 ip6 nexthdr icmpv6 icmpv6 type { destination-unreachable, packet-too-big, time-exceeded, parameter-problem, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert, mld-listener-query, nd-router-solicit } accept
46 ip protocol icmp icmp type { destination-unreachable, router-advertisement, time-exceeded, parameter-problem } accept
49 ip6 nexthdr icmpv6 icmpv6 type echo-request accept
50 ip protocol icmp icmp type echo-request accept
52 # Some .nix append gotos here with: add rule inet filter input iffname ... goto ...
55 type filter hook output priority 0
60 ct state {related,established} accept
63 icmp type echo-request counter accept comment "Ping"
64 tcp dport 22 counter accept comment "SSH"
66 # Some .nix append gotos here with: add rule inet filter output oifname ... goto ...
69 type filter hook forward priority 0