hosts/mermet/networking/nftables.nix

   1 { pkgs, lib, config, hosts, ... }:
   2 let
   3   inherit (builtins) hasAttr readFile;
   4   inherit (pkgs.lib) unlinesAttrs;
   5   inherit (config.users) users groups;
   6 in
   7 {
   8 networking.firewall.enable = false;
   9 security.lockKernelModules = false;
  10 systemd.services.disable-kernel-module-loading.after = [ "nftables.service" ];
  11 # echo -e "$(nix eval hosts.losurdo.config.networking.nftables.ruleset)"
  12 # nft list ruleset
  13 networking.nftables = {
  14   enable = true;
  15   ruleset = lib.mkBefore ''
  16     table inet filter {
  17       include "${../../../networking/nftables/filter.txt}"
  18       chain net2fw {
  19         jump check-public
  20         # Some .nix append rules here with: add rule inet filter net2fw ...
  21       }
  22       chain fw2net {
  23         tcp dport { 80, 443 } counter accept comment "HTTP"
  24         udp dport 123 skuid ${users.systemd-timesync.name} counter accept comment "NTP"
  25         tcp dport 9418 counter accept comment "Git"
  26
  27         # Some .nix append rules here with: add rule inet filter fw2net ...
  28       }
  29       chain lan2fw {
  30         accept
  31         # Some .nix append rules here with: add rule inet filter lan2fw ...
  32       }
  33       chain fw2lan {
  34         accept
  35         # Some .nix append rules here with: add rule inet filter fw2lan ...
  36       }
  37       chain intra2fw {
  38         # Some .nix append rules here with: add rule inet filter intra2fw ...
  39       }
  40       chain fw2intra {
  41         # Some .nix append rules here with: add rule inet filter fw2intra ...
  42       }
  43
  44       chain input {
  45         type filter hook input priority 0
  46         policy drop
  47
  48         iifname lo accept
  49
  50         jump check-tcp
  51         jump check-ping
  52         jump check-broadcast
  53
  54         # accept traffic already established
  55         ct state { established, related } accept
  56         jump accept-connectivity-input
  57         ct state invalid drop
  58
  59         # admin services
  60         tcp dport 22 counter accept comment "SSH"
  61         udp dport 60000-61000 counter accept comment "Mosh"
  62
  63         # Some .nix append gotos here with: add rule inet filter input iffname ... goto ...
  64       }
  65       chain output {
  66         type filter hook output priority 0
  67         policy drop
  68
  69         oifname lo accept
  70
  71         tcp flags syn tcp option maxseg size set rt mtu
  72
  73         ct state { established, related } accept
  74         jump accept-connectivity-output
  75
  76         tcp dport 22 counter accept comment "SSH"
  77
  78         # Some .nix append gotos here with: add rule inet filter output oifname ... goto ...
  79       }
  80       chain forward {
  81         type filter hook forward priority 0
  82         policy drop
  83       }
  84     }
  85     table inet nat {
  86       chain prerouting {
  87         type nat hook prerouting priority filter
  88         policy accept
  89       }
  90       chain postrouting {
  91         type nat hook postrouting priority srcnat
  92         policy accept
  93       }
  94     }
  95   '';
  96 };
  97 }