hosts/losurdo/networking/nftables.nix

   1 { pkgs, lib, config, ... }:
   2 let
   3   inherit (builtins) hasAttr readFile;
   4   inherit (pkgs.lib) unlinesAttrs;
   5   inherit (config) networking;
   6   inherit (config.users) users groups;
   7 in
   8 {
   9 networking.firewall.enable = false;
  10 systemd.services.disable-kernel-module-loading.after = [ "nftables.service" ];
  11 systemd.services.nftables.serviceConfig.TimeoutStartSec = "20";
  12 networking.nftables = {
  13   enable = true;
  14   ruleset = lib.mkBefore ''
  15     table inet filter {
  16       include "${../../../networking/nftables/filter.txt}"
  17       # A set containing the udp port(s) to which SSDP replies are allowed.
  18       set ssdp_out {
  19         type inet_service
  20         timeout 5s
  21       }
  22       chain net2fw {
  23         #udp dport mdns ip6 daddr ff02::fb counter accept comment "Accept mDNS"
  24         #udp dport mdns ip daddr 224.0.0.251 counter accept comment "Accept mDNS"
  25         #jump non-internet
  26
  27         #ct state new add @connlimit { ip saddr ct count over 20 } counter tcp reject with tcp reset
  28
  29         # Some .nix append rules here with: add rule inet filter net2fw ...
  30       }
  31       chain fw2net {
  32         tcp dport { 80, 443 } counter accept comment "HTTP"
  33         udp dport 123 skuid ${users.systemd-timesync.name} counter accept comment "NTP"
  34         tcp dport 1965 counter accept comment "Gemini"
  35         tcp dport 9418 counter accept comment "Git"
  36
  37         # Some .nix append rules here with: add rule inet filter fw2net ...
  38       }
  39       chain wifi2fw {
  40         # Some .nix append rules here with: add rule inet filter wifi2fw ...
  41       }
  42       chain fw2wifi {
  43         # Some .nix append rules here with: add rule inet filter fw2wifi ...
  44       }
  45       chain fwd-wifi {
  46         # Some .nix append rules here with: add rule inet filter fwd-wifi ...
  47       }
  48
  49       chain input {
  50         type filter hook input priority filter
  51         policy drop
  52
  53         iifname lo accept
  54
  55         jump check-tcp
  56         ct state { established, related } accept
  57         jump accept-connectivity-input
  58         ct state invalid counter drop
  59
  60         # admin services
  61         tcp dport 22 counter accept comment "SSH"
  62         udp dport 60000-61000 counter accept comment "Mosh"
  63
  64         # Some .nix append gotos here with: add rule inet filter input iffname ... goto ...
  65       }
  66       chain forward {
  67         type filter hook forward priority filter
  68         policy drop
  69
  70         #tcp flags syn tcp option maxseg size set rt mtu
  71         ct state { related, established } accept
  72         jump accept-connectivity-forward
  73       }
  74       chain output {
  75         type filter hook output priority filter
  76         policy drop
  77
  78         oifname lo accept
  79
  80         tcp flags syn tcp option maxseg size set rt mtu
  81
  82         ct state { related, established } accept
  83         jump accept-connectivity-output
  84
  85         tcp dport 22 counter accept comment "SSH"
  86
  87         # Some .nix append gotos here with: add rule inet filter output oifname ... goto ...
  88       }
  89     }
  90     table inet nat {
  91       chain prerouting {
  92         type nat hook prerouting priority filter
  93         policy accept
  94       }
  95       chain postrouting {
  96         type nat hook postrouting priority srcnat
  97         policy accept
  98       }
  99     }
 100   '';
 101 };
 102 }