nixos: move profile builder

[sourcephile-nix.git] / hosts / losurdo / networking / nftables.nix

diff --git a/hosts/losurdo/networking/nftables.nix b/hosts/losurdo/networking/nftables.nix
index 2ce548e7884d7d88d35ca93f1068147a21764654..52c20bc7f6e8928711f63eb41a0dfcc18f533e1d 100644 (file)
--- a/hosts/losurdo/networking/nftables.nix
+++ b/hosts/losurdo/networking/nftables.nix
@@ -7,14 +7,13 @@ let
 in
 {
 networking.firewall.enable = false;
-security.lockKernelModules = false;
 systemd.services.disable-kernel-module-loading.after = [ "nftables.service" ];
 systemd.services.nftables.serviceConfig.TimeoutStartSec = "20";
 networking.nftables = {
   enable = true;
-  ruleset = lib.mkBefore (''
+  ruleset = lib.mkBefore ''
     table inet filter {
-      include "${../../../var/nftables/filter.txt}"
+      include "${../../../networking/nftables/filter.txt}"
       # A set containing the udp port(s) to which SSDP replies are allowed.
       set ssdp_out {
         type inet_service
@@ -80,6 +79,7 @@ networking.nftables = {
         type filter hook forward priority filter
         policy drop
 
+        #tcp flags syn tcp option maxseg size set rt mtu
         ct state { related, established } accept
         jump accept-connectivity-forward
       }
@@ -89,6 +89,8 @@ networking.nftables = {
 
         oifname lo accept
 
+        tcp flags syn tcp option maxseg size set rt mtu
+
         ct state { related, established } accept
         jump accept-connectivity-output
 
@@ -107,34 +109,6 @@ networking.nftables = {
         policy accept
       }
     }
-  '' + lib.optionalString (config.services.upnpc.redirections != []) (''
-    # Create a rule for accepting any SSDP packets going to a remembered port.
-    add rule inet filter net2fw udp dport @ssdp_out \
-      counter accept comment "SSDP answer"
-    add rule inet filter fw2net \
-      skuid {${users.upnpc.name},${users.nsupdate.name}} \
-      tcp dport 1900 \
-      counter accept \
-      comment "SSDP automatic opening"
-    add rule inet filter fw2net \
-      skuid {${users.upnpc.name},${users.nsupdate.name}} \
-      ip daddr 239.255.255.250 udp dport 1900 \
-      set add udp sport @ssdp_out \
-      comment "SSDP automatic opening"
-    add rule inet filter fw2net \
-      skuid {${users.upnpc.name},${users.nsupdate.name}} \
-      ip daddr 239.255.255.250 udp dport 1900 \
-      counter accept comment "SSDP"
-    '' + lib.optionalString config.networking.enableIPv6 ''
-    add rule inet filter fw2net \
-      skuid {${users.upnpc.name},${users.nsupdate.name}} \
-      ip6 daddr {FF02::C, FF05::C, FF08::C, FF0E::C} udp dport 1900 \
-      set add udp sport @ssdp_out comment "SSDP automatic opening"
-    add rule inet filter fw2net \
-      skuid {${users.upnpc.name},${users.nsupdate.name}} \
-      ip6 daddr {FF02::C, FF05::C, FF08::C, FF0E::C} udp dport 1900 \
-      counter accept comment "SSDP"
-    '')
-  );
+  '';
 };
 }