hosts/losurdo/networking/nftables.nix

   1 { pkgs, lib, config, ... }:
   2 let
   3   inherit (builtins) hasAttr readFile;
   4   inherit (pkgs.lib) unlinesAttrs;
   5   inherit (config) networking;
   6   inherit (config.users) users groups;
   7 in
   8 {
   9 networking.firewall.enable = false;
  10 systemd.services.disable-kernel-module-loading.after = [ "nftables.service" ];
  11 systemd.services.nftables.serviceConfig.TimeoutStartSec = "20";
  12 networking.nftables = {
  13   enable = true;
  14   ruleset = lib.mkBefore ''
  15     table inet filter {
  16       include "${../../../networking/nftables/filter.txt}"
  17       # A set containing the udp port(s) to which SSDP replies are allowed.
  18       set ssdp_out {
  19         type inet_service
  20         timeout 5s
  21       }
  22       chain net2fw {
  23         #udp dport mdns ip6 daddr ff02::fb counter accept comment "Accept mDNS"
  24         #udp dport mdns ip daddr 224.0.0.251 counter accept comment "Accept mDNS"
  25         #jump non-internet
  26
  27         #ct state new add @connlimit { ip saddr ct count over 20 } counter tcp reject with tcp reset
  28
  29         # Some .nix append rules here with: add rule inet filter net2fw ...
  30       }
  31       chain fw2net {
  32         tcp dport { 80, 443 } counter accept comment "HTTP"
  33         udp dport 123 skuid ${users.systemd-timesync.name} counter accept comment "NTP"
  34         tcp dport 1965 counter accept comment "Gemini"
  35         tcp dport 9418 counter accept comment "Git"
  36
  37         # Some .nix append rules here with: add rule inet filter fw2net ...
  38       }
  39       chain wifi2fw {
  40         # Some .nix append rules here with: add rule inet filter wifi2fw ...
  41       }
  42       chain fw2wifi {
  43         # Some .nix append rules here with: add rule inet filter fw2wifi ...
  44       }
  45       chain fwd-wifi {
  46         # Some .nix append rules here with: add rule inet filter fwd-wifi ...
  47       }
  48       chain intra2fw {
  49         # Some .nix append rules here with: add rule inet filter intra2fw ...
  50       }
  51       chain fw2intra {
  52         # Some .nix append rules here with: add rule inet filter fw2intra ...
  53       }
  54       chain fwd-intra {
  55         # Some .nix append rules here with: add rule inet filter fwd-intra ...
  56       }
  57       chain extra2fw {
  58         # Some .nix append rules here with: add rule inet filter extra2fw ...
  59       }
  60
  61       chain input {
  62         type filter hook input priority filter
  63         policy drop
  64
  65         iifname lo accept
  66
  67         jump check-tcp
  68         ct state { established, related } accept
  69         jump accept-connectivity-input
  70         ct state invalid counter drop
  71
  72         # admin services
  73         tcp dport 22 counter accept comment "SSH"
  74         udp dport 60000-61000 counter accept comment "Mosh"
  75
  76         # Some .nix append gotos here with: add rule inet filter input iffname ... goto ...
  77       }
  78       chain forward {
  79         type filter hook forward priority filter
  80         policy drop
  81
  82         #tcp flags syn tcp option maxseg size set rt mtu
  83         ct state { related, established } accept
  84         jump accept-connectivity-forward
  85       }
  86       chain output {
  87         type filter hook output priority filter
  88         policy drop
  89
  90         oifname lo accept
  91
  92         tcp flags syn tcp option maxseg size set rt mtu
  93
  94         ct state { related, established } accept
  95         jump accept-connectivity-output
  96
  97         tcp dport 22 counter accept comment "SSH"
  98
  99         # Some .nix append gotos here with: add rule inet filter output oifname ... goto ...
 100       }
 101     }
 102     table inet nat {
 103       chain prerouting {
 104         type nat hook prerouting priority filter
 105         policy accept
 106       }
 107       chain postrouting {
 108         type nat hook postrouting priority srcnat
 109         policy accept
 110       }
 111     }
 112   '';
 113 };
 114 }