]> Git — Sourcephile - sourcephile-nix.git/blob - machines/losurdo/networking/nftables.nix
nix: servers.nix -> machines.nix
[sourcephile-nix.git] / machines / losurdo / networking / nftables.nix
1 { pkgs, lib, config, machines, ... }:
2 let
3 inherit (builtins) hasAttr readFile;
4 inherit (pkgs.lib) unlinesAttrs;
5 inherit (config.users) users groups;
6 in
7 {
8 networking.firewall.enable = false;
9 security.lockKernelModules = false;
10 systemd.services.disable-kernel-module-loading.after = [ "nftables.service" ];
11 # echo -e "$(nix eval machines.losurdo.config.networking.nftables.ruleset)"
12 # nft list ruleset
13 networking.nftables = {
14 enable = true;
15 ruleset = lib.mkBefore ''
16 table inet filter {
17 chain net2fw {
18 # Some .nix append rules here with: add rule inet filter net2fw ...
19 }
20 chain fw2net {
21 tcp dport {80,443} counter accept comment "HTTP"
22 udp dport 123 skuid ${users.systemd-timesync.name} counter accept comment "NTP"
23 tcp dport 9418 counter accept comment "Git"
24
25 # Some .nix append rules here with: add rule inet filter fw2net ...
26 }
27
28 chain input {
29 type filter hook input priority 0
30 policy drop
31
32 iifname lo accept
33
34 # accept traffic already established
35 ct state {established, related} accept
36 ct state invalid drop
37
38 # admin services
39 tcp dport 22 counter accept comment "SSH"
40 udp dport 60000-61000 counter accept comment "Mosh"
41
42 # ICMP
43 ip6 nexthdr icmpv6 icmpv6 type { destination-unreachable, packet-too-big, time-exceeded, parameter-problem, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert, mld-listener-query, nd-router-solicit } accept
44 ip protocol icmp icmp type { destination-unreachable, router-advertisement, time-exceeded, parameter-problem } accept
45
46 # allow "ping"
47 ip6 nexthdr icmpv6 icmpv6 type echo-request accept
48 ip protocol icmp icmp type echo-request accept
49
50 # Some .nix append gotos here with: add rule inet filter input iffname ... goto ...
51 }
52 chain output {
53 type filter hook output priority 0
54 policy drop
55
56 oifname lo accept
57
58 ct state {related,established} accept
59 ct state invalid drop
60
61 icmp type echo-request counter accept comment "Ping"
62 tcp dport 22 counter accept comment "SSH"
63
64 # Some .nix append gotos here with: add rule inet filter output oifname ... goto ...
65 }
66 chain forward {
67 type filter hook forward priority 0
68 policy drop
69 drop
70 }
71 }
72 '';
73 };
74 }