Cloonar/nixos
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

change firewall rules

Browse Source
This commit is contained in:
Dominik Polakovics Polakovics
2023-12-04 08:22:15 +01:00
parent 76cd48e6af
commit 4c91007286
1 changed files with 86 additions and 126 deletions
Download Patch File Download Diff File Expand all files Collapse all files

66
hosts/fw.cloonar.com/modules/firewall.nix
View File

@@ -1,55 +1,12 @@
{ ... }: { { ... }: {
networking = { networking = {
nat.enable = false; nat.enable = false;
# firewall = {
# enable = true;
# extraCommands = ''
# iptables -A INPUT -i lo -j ACCEPT
# iptables -A INPUT -i wan -j ACCEPT
# iptables -A INPUT -i lan -j ACCEPT
# iptables -A INPUT -i wg_cloonar -j ACCEPT
# iptables -A INPUT -p udp -i infrastructure -m multiport --dports 53,67,68 -j ACCEPT
# iptables -A INPUT -p udp -i smart -m multiport --dports 53,67,68 -j ACCEPT
# iptables -A INPUT -p udp -i multimedia -m multiport --dports 53,67,68 -j ACCEPT
# iptables -A INPUT -p udp -i podman0 -m multiport --dports 53,67,68 -j ACCEPT
# iptables -A INPUT -p tcp -i infrastructure -m multiport --dports 80,443,453 -j ACCEPT
# iptables -A INPUT -p tcp -i smart -m multiport --dports 80,443,453 -j ACCEPT
# iptables -A INPUT -p tcp -i multimedia -m multiport --dports 80,443,453 -j ACCEPT
# iptables -A INPUT -p tcp -i podman0 -m multiport --dports 80,443,453 -j ACCEPT
#
# iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
#
# iptables -A FORWARD -i wan -d 10.42.0.0/16 -j ACCEPT
# iptables -A FORWARD -i lan -d 10.42.0.0/16 -j ACCEPT
# iptables -A FORWARD -i podman0 -d 10.42.0.0/16 -j ACCEPT
# iptables -A FORWARD -i wg_cloonar -d 10.42.0.0/16 -j ACCEPT
#
# iptables -A FORWARD -i lan -o wan -j ACCEPT
# iptables -A FORWARD -i infrastructure -o wan -j ACCEPT
# iptables -A FORWARD -i podman0 -o wan -j ACCEPT
# iptables -A FORWARD -i multimedia -o wan -j ACCEPT
# iptables -A FORWARD -i smart -o wan -j ACCEPT
# iptables -A FORWARD -i wg_cloonar -o wan -j ACCEPT
#
# iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
#
# iptables -t nat -A POSTROUTING -o wan -j MASQUERADE
# iptables -t nat -A POSTROUTING -o wrwks -j MASQUERADE
# iptables -t nat -A POSTROUTING -o wg_epicenter -j MASQUERADE
# iptables -t nat -A POSTROUTING -o wg_ghetto_at -j MASQUERADE
# '';
# };
nftables = { nftables = {
enable = true; enable = true;
ruleset = '' tables = {
table inet filter { "cloonar-fw" = {
# enable flow offloading for better throughput family = "inet";
# flowtable f { content = ''
# hook ingress priority 0;
# devices = { lan, server, wg_cloonar, smart, multimedia, guest };
# }
chain output { chain output {
type filter hook output priority 100; policy accept; type filter hook output priority 100; policy accept;
} }
@@ -127,9 +84,11 @@
"wan", "wan",
} counter accept comment "Allow trusted LAN to WAN" } counter accept comment "Allow trusted LAN to WAN"
} }
} '';
};
table ip nat { "cloonar-nat" = {
family = "ip";
content = ''
chain prerouting { chain prerouting {
type nat hook prerouting priority filter; policy accept; type nat hook prerouting priority filter; policy accept;
} }
@@ -138,10 +97,11 @@
chain postrouting { chain postrouting {
type nat hook postrouting priority filter; policy accept; type nat hook postrouting priority filter; policy accept;
oifname { "wan", "wrwks", "wg_epicenter", "wg_ghetto_at" } masquerade oifname { "wan", "wrwks", "wg_epicenter", "wg_ghetto_at" } masquerade
iifname { "vb-*" } oifname { "server" } masquerade comment "from internal interfaces" # iifname { "vb-*" } oifname { "server" } masquerade comment "from internal interfaces"
} }
} ''
''; };
};
}; };
}; };
} }