machines/losurdo/networking/nftables.nix

   1 { pkgs, lib, config, machines, ... }:
   2 let
   3   inherit (builtins) hasAttr readFile;
   4   inherit (pkgs.lib) unlinesAttrs;
   5   inherit (config.users) users groups;
   6 in
   7 {
   8 networking.firewall.enable = false;
   9 security.lockKernelModules = false;
  10 systemd.services.disable-kernel-module-loading.after = [ "nftables.service" ];
  11 systemd.services.nftables.serviceConfig.TimeoutStartSec = "20";
  12 networking.nftables = {
  13   enable = true;
  14   ruleset = lib.mkBefore ''
  15     table inet filter {
  16       set lograte4 { type ipv4_addr; size 65535; flags dynamic; }
  17       set lograte6 { type ipv6_addr; size 65535; flags dynamic; }
  18       chain ping-flood {
  19         add @lograte4 { ip  saddr limit rate 1/minute } log level warn prefix "ping-flood: "
  20         add @lograte6 { ip6 saddr limit rate 1/minute } log level warn prefix "ping-flood: "
  21         counter drop
  22       }
  23       chain check-ping {
  24         ip protocol icmp   icmp   type echo-request limit rate over 10/second burst 20 packets goto ping-flood
  25         ip6 nexthdr icmpv6 icmpv6 type echo-request limit rate over 10/second burst 20 packets goto ping-flood
  26       }
  27       chain smurf {
  28         add @lograte4 { ip  saddr limit rate 1/minute } log level warn prefix "smurf: "
  29         add @lograte6 { ip6 saddr limit rate 1/minute } log level warn prefix "smurf: "
  30         counter drop
  31       }
  32       chain check-broadcast {
  33         ip saddr 0.0.0.0/32 counter accept comment "DHCP broadcast"
  34         fib saddr type broadcast counter goto smurf
  35         ip saddr 224.0.0.0/4     counter goto smurf
  36       }
  37       chain bogus-tcp {
  38         add @lograte4 { ip  saddr limit rate 1/minute } log level warn prefix "bogus-tcp: "
  39         add @lograte6 { ip6 saddr limit rate 1/minute } log level warn prefix "bogus-tcp: "
  40         counter drop
  41       }
  42       chain syn-flood {
  43         add @lograte4 { ip  saddr limit rate 1/minute } log level warn prefix "syn-flood: "
  44         add @lograte6 { ip6 saddr limit rate 1/minute } log level warn prefix "syn-flood: "
  45         counter drop
  46       }
  47       chain check-tcp {
  48         tcp flags syn tcp option maxseg size != 536-65535 counter goto bogus-tcp
  49         tcp flags & (ack|fin) == fin counter goto bogus-tcp
  50         tcp flags & (ack|psh) == psh counter goto bogus-tcp
  51         tcp flags & (ack|urg) == urg counter goto bogus-tcp
  52         tcp flags & (fin|ack) == fin counter goto bogus-tcp
  53         tcp flags & (fin|rst) == (fin|rst) counter goto bogus-tcp
  54         tcp flags & (fin|psh|ack) == (fin|psh) counter goto bogus-tcp
  55         tcp flags & (syn|fin) == (syn|fin) counter goto bogus-tcp comment "SYN-FIN scan"
  56         tcp flags & (syn|rst) == (syn|rst) counter goto bogus-tcp comment "SYN-RST scan"
  57         tcp flags == (fin|syn|rst|psh|ack|urg) counter goto bogus-tcp comment "XMAS scan"
  58         tcp flags == 0x0 counter goto bogus-tcp comment "NULL scan"
  59         tcp flags == (fin|urg|psh) counter goto bogus-tcp
  60         tcp flags == (fin|urg|psh|syn) counter goto bogus-tcp comment "NMAP-ID"
  61         tcp flags == (fin|urg|syn|rst|ack) counter goto bogus-tcp
  62
  63         ct state new tcp flags != syn counter goto bogus-tcp
  64         tcp sport 0 tcp flags & (fin|syn|rst|ack) == syn counter goto bogus-tcp
  65         tcp flags & (fin|syn|rst|ack) == syn counter limit rate over 30/second burst 60 packets goto syn-flood
  66       }
  67       chain net2fw {
  68         #udp dport mdns ip6 daddr ff02::fb counter accept comment "Accept mDNS"
  69         #udp dport mdns ip daddr 224.0.0.251 counter accept comment "Accept mDNS"
  70         #jump non-internet
  71
  72         #ct state new add @connlimit { ip saddr ct count over 20 } counter tcp reject with tcp reset
  73
  74         # Some .nix append rules here with: add rule inet filter net2fw ...
  75       }
  76       chain fw2net {
  77         ip daddr 224.0.0.0/4 udp dport 1900 counter accept comment "UPnP"
  78         tcp dport { 80, 443 } counter accept comment "HTTP"
  79         udp dport 123 skuid ${users.systemd-timesync.name} counter accept comment "NTP"
  80         tcp dport 9418 counter accept comment "Git"
  81
  82         # Some .nix append rules here with: add rule inet filter fw2net ...
  83       }
  84       chain intra2fw {
  85         # Some .nix append rules here with: add rule inet filter intra2fw ...
  86       }
  87       chain fw2intra {
  88         # Some .nix append rules here with: add rule inet filter fw2intra ...
  89       }
  90       chain fwd-intra {
  91         # Some .nix append rules here with: add rule inet filter fwd-intra ...
  92       }
  93
  94       chain input {
  95         type filter hook input priority 0
  96         policy drop
  97
  98         iifname lo accept
  99
 100         jump check-tcp
 101         jump check-ping
 102         jump check-broadcast
 103
 104         ct state { established, related } accept
 105         ct state invalid counter drop
 106
 107         # admin services
 108         tcp dport 22 counter accept comment "SSH"
 109         udp dport 60000-61000 counter accept comment "Mosh"
 110
 111         # ICMP
 112         ip protocol icmp icmp type echo-request counter accept
 113         ip protocol icmp icmp type destination-unreachable counter accept
 114         ip protocol icmp icmp type router-solicitation counter accept
 115         ip protocol icmp icmp type router-advertisement counter accept
 116         ip protocol icmp icmp type time-exceeded counter accept
 117         ip protocol icmp icmp type parameter-problem counter accept
 118         ip protocol icmp log level warn prefix "net2fw: icmpv: " counter accept
 119         #ip protocol icmp icmp type { echo-request, destination-unreachable, router-solicitation, router-advertisement, time-exceeded, parameter-problem } counter accept
 120
 121         ip6 nexthdr icmpv6 icmpv6 type echo-request counter accept
 122         ip6 nexthdr icmpv6 icmpv6 type nd-neighbor-solicit counter accept
 123         ip6 nexthdr icmpv6 icmpv6 type nd-neighbor-advert counter accept
 124         ip6 nexthdr icmpv6 icmpv6 type nd-router-solicit counter accept
 125         ip6 nexthdr icmpv6 icmpv6 type nd-router-advert counter accept
 126         ip6 nexthdr icmpv6 icmpv6 type mld-listener-query counter accept
 127         ip6 nexthdr icmpv6 icmpv6 type mld-listener-report counter accept
 128         ip6 nexthdr icmpv6 icmpv6 type mld-listener-reduction counter accept
 129         ip6 nexthdr icmpv6 icmpv6 type destination-unreachable counter accept
 130         ip6 nexthdr icmpv6 icmpv6 type packet-too-big counter accept
 131         ip6 nexthdr icmpv6 icmpv6 type time-exceeded counter accept
 132         ip6 nexthdr icmpv6 icmpv6 type parameter-problem counter accept
 133         ip6 nexthdr icmpv6 icmpv6 type ind-neighbor-solicit counter accept
 134         ip6 nexthdr icmpv6 icmpv6 type ind-neighbor-advert counter accept
 135         ip6 nexthdr icmpv6 icmpv6 type mld2-listener-report counter accept
 136         ip6 nexthdr icmpv6 log level warn prefix "net2fw: icmpv6: " counter accept
 137         #ip6 nexthdr icmpv6 icmpv6 type { echo-request, nd-neighbor-solicit, nd-neighbor-advert, nd-router-solicit, nd-router-advert, mld-listener-query, mld-listener-report, mld-listener-reduction, destination-unreachable, packet-too-big, time-exceeded, parameter-problem, ind-neighbor-solicit, ind-neighbor-advert, mld2-listener-report } counter accept
 138
 139         # Some .nix append gotos here with: add rule inet filter input iffname ... goto ...
 140       }
 141       chain output {
 142         type filter hook output priority 0
 143         policy drop
 144
 145         oifname lo accept
 146
 147         ct state { related, established } accept
 148         ct state invalid counter drop
 149
 150         # ICMP
 151         ip protocol icmp counter accept
 152         ip6 nexthdr icmpv6 counter accept
 153
 154         tcp dport 22 counter accept comment "SSH"
 155
 156         # Some .nix append gotos here with: add rule inet filter output oifname ... goto ...
 157       }
 158       chain forward {
 159         type filter hook forward priority 0
 160         policy drop
 161       }
 162     }
 163   '';
 164 };
 165 }