servers/losurdo/shorewall.nix

   1 { pkgs, lib, config, ... }:
   2 let
   3   inherit (builtins) hasAttr readFile;
   4   inherit (pkgs.lib) unlinesAttrs;
   5   inherit (config.users) users groups;
   6   inherit (config.services) shorewall shorewall6 transmission;
   7   fw2net = ''
   8     # By protocol
   9     Ping(ACCEPT)   $FW net
  10
  11     # By port
  12     DNS(ACCEPT)    $FW net {user=${users.unbound.name}}
  13     Git(ACCEPT)    $FW net
  14     HKP(ACCEPT)    $FW net {user=${users.julm.name}}
  15     HTTP(ACCEPT)   $FW net
  16     HTTPS(ACCEPT)  $FW net
  17     ACCEPT         $FW net {proto=tcp, dport=8080}
  18     IRCS(ACCEPT)   $FW net {user=${users.julm.name}}
  19     NTP(ACCEPT)    $FW net {user=${users.systemd-timesync.name}}
  20     SMTP(ACCEPT)   $FW net
  21     SMTPS(ACCEPT)  $FW net
  22     SSH(ACCEPT)    $FW net
  23     Whois(ACCEPT)  $FW net
  24   '';
  25   net2fw = ''
  26     # By protocol
  27     Ping(ACCEPT)   net $FW
  28
  29     # By port
  30     DNS(ACCEPT)    net $FW
  31     HTTP(ACCEPT)   net $FW
  32     HTTPS(ACCEPT)  net $FW
  33     IMAPS(ACCEPT)  net $FW
  34     Mosh(ACCEPT)   net $FW
  35     POP3S(ACCEPT)  net $FW
  36     SMTP(ACCEPT)   net $FW
  37     SMTPS(ACCEPT)  net $FW
  38     SSH(ACCEPT)    net $FW {rate=s:1/min:10}
  39     ACCEPT         net $FW {proto=tcp, dport=2222}
  40     Sieve(ACCEPT)  net $FW
  41   '';
  42   macros = {
  43     "macro.Git" = ''
  44       ?FORMAT 2
  45       #ACTION SOURCE  DEST    PROTO   DEST    SOURCE  RATE    USER/
  46       #                               PORT(S) PORT(S) LIMIT   GROUP
  47       PARAM   -       -       tcp     9418
  48     '';
  49     "macro.IRCS" = ''
  50       ?FORMAT 2
  51       #ACTION SOURCE  DEST    PROTO   DEST    SOURCE  RATE    USER/
  52       #                               PORT(S) PORT(S) LIMIT   GROUP
  53       PARAM   -       -       tcp     6697
  54     '';
  55     "macro.Mosh" = ''
  56       ?FORMAT 2
  57       #ACTION SOURCE  DEST    PROTO   DEST    SOURCE  RATE    USER/
  58       #                               PORT(S) PORT(S) LIMIT   GROUP
  59       PARAM   -       -       udp     60000-61000
  60     '';
  61   };
  62 in
  63 {
  64 services.shorewall = {
  65   enable  = true;
  66   configs = macros // {
  67     "shorewall.conf" = ''
  68       ${readFile "${shorewall.package}/etc-example/shorewall/shorewall.conf"}
  69       #
  70       ## Custom config
  71       ###
  72       STARTUP_ENABLED=Yes
  73       ZONE2ZONE=2
  74     '';
  75     zones = ''
  76       # DOC: shorewall-zones(5)
  77       fw firewall
  78       net    ipv4
  79       wet    ipv4
  80     '';
  81     interfaces = ''
  82       # DOC: shorewall-interfaces(5)
  83       ?FORMAT 2
  84       net   enp5s0 arp_filter,nosmurfs,routefilter=1,tcpflags,upnpclient
  85       wet   wlp4s0 arp_filter,nosmurfs,routefilter=1,tcpflags
  86     '';
  87     policy = ''
  88       # DOC: shorewall-policy(5)
  89       $FW    all DROP
  90       net    all DROP   none
  91       wet    all DROP   none
  92       # WARNING: the following policy must be last
  93       all    all REJECT none
  94     '';
  95     rules = lib.mkBefore ''
  96       # DOC: shorewall-rules(5)
  97       #SECTION ALL
  98       #SECTION ESTABLISHED
  99       #SECTION RELATED
 100       ?SECTION NEW
 101
 102       ${fw2net}
 103       ACCEPT $FW net:192.168.0.0/16
 104       ACCEPT $FW net:224.0.0.0/4 udp 1900 # UPnP
 105       ACCEPT $FW net udp {user=${users.transmission.name}} # BitTorrent
 106       ${net2fw}
 107       ACCEPT net $FW tcp ${toString transmission.settings.peer-port} # BitTorrent
 108       ACCEPT net $FW udp ${toString transmission.settings.peer-port} # BitTorrent
 109     '';
 110   };
 111 };
 112 services.shorewall6 = {
 113   enable  = true;
 114   configs = macros // {
 115     "shorewall6.conf" = ''
 116       ${readFile "${shorewall6.package}/etc-example/shorewall6/shorewall6.conf"}
 117       #
 118       ## Custom config
 119       ###
 120       STARTUP_ENABLED=Yes
 121       ZONE2ZONE=2
 122       '';
 123     zones = ''
 124       # DOC: shorewall-zones(5)
 125       fw firewall
 126       net    ipv6
 127       wet    ipv6
 128     '';
 129     interfaces = ''
 130       # DOC: shorewall-interfaces(5)
 131       ?FORMAT 2
 132       net    enp5s0 nosmurfs,tcpflags
 133       wet    wlp4s0 nosmurfs,tcpflags
 134     '';
 135     policy = ''
 136       # DOC: shorewall-policy(5)
 137       $FW    all DROP
 138       net    all DROP   none
 139       wet    all DROP   none
 140       # WARNING: the following policy must be last
 141       all    all REJECT none
 142     '';
 143     rules = lib.mkBefore ''
 144       # DOC: shorewall-rules(5)
 145       #SECTION ALL
 146       #SECTION ESTABLISHED
 147       #SECTION RELATED
 148       ?SECTION NEW
 149
 150       ${fw2net}
 151       ${net2fw}
 152     '';
 153   };
 154 };
 155 }