]> Git — Sourcephile - sourcephile-nix.git/blob - hosts/losurdo/networking/nftables.nix
nix: update inputs
[sourcephile-nix.git] / hosts / losurdo / networking / nftables.nix
1 { pkgs, lib, config, ... }:
2 let
3 inherit (builtins) hasAttr readFile;
4 inherit (pkgs.lib) unlinesAttrs;
5 inherit (config) networking;
6 inherit (config.users) users groups;
7 in
8 {
9 networking.firewall.enable = false;
10 systemd.services.disable-kernel-module-loading.after = [ "nftables.service" ];
11 systemd.services.nftables.serviceConfig.TimeoutStartSec = "20";
12 networking.nftables = {
13 enable = true;
14 ruleset = lib.mkBefore ''
15 table inet filter {
16 include "${../../../networking/nftables/filter.txt}"
17 # A set containing the udp port(s) to which SSDP replies are allowed.
18 set ssdp_out {
19 type inet_service
20 timeout 5s
21 }
22 chain net2fw {
23 #udp dport mdns ip6 daddr ff02::fb counter accept comment "Accept mDNS"
24 #udp dport mdns ip daddr 224.0.0.251 counter accept comment "Accept mDNS"
25 #jump non-internet
26
27 #ct state new add @connlimit { ip saddr ct count over 20 } counter tcp reject with tcp reset
28
29 # Some .nix append rules here with: add rule inet filter net2fw ...
30 }
31 chain fw2net {
32 tcp dport { 80, 443 } counter accept comment "HTTP"
33 udp dport 123 skuid ${users.systemd-timesync.name} counter accept comment "NTP"
34 tcp dport 1965 counter accept comment "Gemini"
35 tcp dport 9418 counter accept comment "Git"
36
37 # Some .nix append rules here with: add rule inet filter fw2net ...
38 }
39 chain wifi2fw {
40 # Some .nix append rules here with: add rule inet filter wifi2fw ...
41 }
42 chain fw2wifi {
43 # Some .nix append rules here with: add rule inet filter fw2wifi ...
44 }
45 chain fwd-wifi {
46 # Some .nix append rules here with: add rule inet filter fwd-wifi ...
47 }
48 chain intra2fw {
49 # Some .nix append rules here with: add rule inet filter intra2fw ...
50 }
51 chain fw2intra {
52 # Some .nix append rules here with: add rule inet filter fw2intra ...
53 }
54 chain fwd-intra {
55 # Some .nix append rules here with: add rule inet filter fwd-intra ...
56 }
57 chain extra2fw {
58 # Some .nix append rules here with: add rule inet filter extra2fw ...
59 }
60
61 chain input {
62 type filter hook input priority filter
63 policy drop
64
65 iifname lo accept
66
67 jump check-tcp
68 ct state { established, related } accept
69 jump accept-connectivity-input
70 ct state invalid counter drop
71
72 # admin services
73 tcp dport 22 counter accept comment "SSH"
74 udp dport 60000-61000 counter accept comment "Mosh"
75
76 # Some .nix append gotos here with: add rule inet filter input iffname ... goto ...
77 }
78 chain forward {
79 type filter hook forward priority filter
80 policy drop
81
82 #tcp flags syn tcp option maxseg size set rt mtu
83 ct state { related, established } accept
84 jump accept-connectivity-forward
85 }
86 chain output {
87 type filter hook output priority filter
88 policy drop
89
90 oifname lo accept
91
92 tcp flags syn tcp option maxseg size set rt mtu
93
94 ct state { related, established } accept
95 jump accept-connectivity-output
96
97 tcp dport 22 counter accept comment "SSH"
98
99 # Some .nix append gotos here with: add rule inet filter output oifname ... goto ...
100 }
101 }
102 table inet nat {
103 chain prerouting {
104 type nat hook prerouting priority filter
105 policy accept
106 }
107 chain postrouting {
108 type nat hook postrouting priority srcnat
109 policy accept
110 }
111 }
112 '';
113 };
114 }