Cloonar/nixos
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

change firewall rules

Browse Source
This commit is contained in:
Dominik Polakovics Polakovics
2023-12-04 08:22:15 +01:00
parent 76cd48e6af
commit 4c91007286
1 changed files with 86 additions and 126 deletions
Download Patch File Download Diff File Expand all files Collapse all files

212
hosts/fw.cloonar.com/modules/firewall.nix
View File

@@ -1,147 +1,107 @@
{ ... }: { { ... }: {
networking = { networking = {
nat.enable = false; nat.enable = false;
# firewall = {
# enable = true;
# extraCommands = ''
# iptables -A INPUT -i lo -j ACCEPT
# iptables -A INPUT -i wan -j ACCEPT
# iptables -A INPUT -i lan -j ACCEPT
# iptables -A INPUT -i wg_cloonar -j ACCEPT
# iptables -A INPUT -p udp -i infrastructure -m multiport --dports 53,67,68 -j ACCEPT
# iptables -A INPUT -p udp -i smart -m multiport --dports 53,67,68 -j ACCEPT
# iptables -A INPUT -p udp -i multimedia -m multiport --dports 53,67,68 -j ACCEPT
# iptables -A INPUT -p udp -i podman0 -m multiport --dports 53,67,68 -j ACCEPT
# iptables -A INPUT -p tcp -i infrastructure -m multiport --dports 80,443,453 -j ACCEPT
# iptables -A INPUT -p tcp -i smart -m multiport --dports 80,443,453 -j ACCEPT
# iptables -A INPUT -p tcp -i multimedia -m multiport --dports 80,443,453 -j ACCEPT
# iptables -A INPUT -p tcp -i podman0 -m multiport --dports 80,443,453 -j ACCEPT
#
# iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
#
# iptables -A FORWARD -i wan -d 10.42.0.0/16 -j ACCEPT
# iptables -A FORWARD -i lan -d 10.42.0.0/16 -j ACCEPT
# iptables -A FORWARD -i podman0 -d 10.42.0.0/16 -j ACCEPT
# iptables -A FORWARD -i wg_cloonar -d 10.42.0.0/16 -j ACCEPT
#
# iptables -A FORWARD -i lan -o wan -j ACCEPT
# iptables -A FORWARD -i infrastructure -o wan -j ACCEPT
# iptables -A FORWARD -i podman0 -o wan -j ACCEPT
# iptables -A FORWARD -i multimedia -o wan -j ACCEPT
# iptables -A FORWARD -i smart -o wan -j ACCEPT
# iptables -A FORWARD -i wg_cloonar -o wan -j ACCEPT
#
# iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
#
# iptables -t nat -A POSTROUTING -o wan -j MASQUERADE
# iptables -t nat -A POSTROUTING -o wrwks -j MASQUERADE
# iptables -t nat -A POSTROUTING -o wg_epicenter -j MASQUERADE
# iptables -t nat -A POSTROUTING -o wg_ghetto_at -j MASQUERADE
# '';
# };
nftables = { nftables = {
enable = true; enable = true;
ruleset = '' tables = {
table inet filter { "cloonar-fw" = {
# enable flow offloading for better throughput family = "inet";
# flowtable f { content = ''
# hook ingress priority 0; chain output {
# devices = { lan, server, wg_cloonar, smart, multimedia, guest }; type filter hook output priority 100; policy accept;
# } }
chain output { chain input {
type filter hook output priority 100; policy accept; type filter hook input priority filter; policy drop;
}
chain input { # accept any localhost traffic
type filter hook input priority filter; policy drop; iifname lo accept
# accept any localhost traffic # Allow trusted networks to access the router
iifname lo accept iifname {
"wan", # disable when final
"lan",
"wg_cloonar"
} counter accept
# Allow trusted networks to access the router # Allow networks to access the dns and dhcp
iifname { iifname {
"wan", # disable when final "lan",
"lan", "vb-*",
"wg_cloonar" "podman0",
} counter accept "infrastructure",
"wg_cloonar",
"smart",
"multimedia"
} udp dport { 53, 67, 68 } counter accept
iifname {
"lan",
"podman0",
"vb-*",
"infrastructure",
"wg_cloonar",
"smart",
"multimedia"
} tcp dport { 80, 443, 853 } counter accept
# Allow networks to access the dns and dhcp # Accept mDNS for avahi reflection
iifname { # iifname "multimedia" ip saddr <chromecast IP> tcp dport { llmnr } counter accept
"lan", # iifname "multimedia" ip saddr <chromecast IP> udp dport { mdns, llmnr } counter accept
"vb-*",
"podman0",
"infrastructure",
"wg_cloonar",
"smart",
"multimedia"
} udp dport { 53, 67, 68 } counter accept
iifname {
"lan",
"podman0",
"vb-*",
"infrastructure",
"wg_cloonar",
"smart",
"multimedia"
} tcp dport { 80, 443, 853 } counter accept
# Accept mDNS for avahi reflection # Allow returning traffic from wg_cloonar and drop everthing else
# iifname "multimedia" ip saddr <chromecast IP> tcp dport { llmnr } counter accept iifname "wg_cloonar" ct state { established, related } counter accept
# iifname "multimedia" ip saddr <chromecast IP> udp dport { mdns, llmnr } counter accept iifname "wg_cloonar" drop
# Allow returning traffic from wg_cloonar and drop everthing else iifname "wan" ct state { established, related } accept comment "Allow established traffic"
iifname "wg_cloonar" ct state { established, related } counter accept iifname "wan" icmp type { echo-request, destination-unreachable, time-exceeded } counter accept comment "Allow select ICMP"
iifname "wg_cloonar" drop iifname "wan" counter drop comment "Drop all other unsolicited traffic from wan"
}
iifname "wan" ct state { established, related } accept comment "Allow established traffic" chain forward {
iifname "wan" icmp type { echo-request, destination-unreachable, time-exceeded } counter accept comment "Allow select ICMP" type filter hook forward priority filter; policy drop;
iifname "wan" counter drop comment "Drop all other unsolicited traffic from wan"
}
chain forward { # enable flow offloading for better throughput
type filter hook forward priority filter; policy drop; # ip protocol { tcp, udp } flow offload @f
# enable flow offloading for better throughput # multimedia airplay
# ip protocol { tcp, udp } flow offload @f iifname "multimedia" oifname { "lan" } counter accept
# multimedia airplay # lan and vpn to any
iifname "multimedia" oifname { "lan" } counter accept # TODO: disable wan when finished
iifname { "wan", "lan", "vb-*", "podman0", "wg_cloonar" } oifname { "lan", "vb-*", "podman0", "infrastructure", "multimedia", "smart", "wrwks", "wg_cloonar", "wg_epicenter", "wg_ghetto_at" } counter accept
iifname { "infrastructure" } oifname { "podman0", "vb-omada" } counter accept
# lan and vpn to any # Allow trusted network WAN access
# TODO: disable wan when finished iifname {
iifname { "wan", "lan", "vb-*", "podman0", "wg_cloonar" } oifname { "lan", "vb-*", "podman0", "infrastructure", "multimedia", "smart", "wrwks", "wg_cloonar", "wg_epicenter", "wg_ghetto_at" } counter accept "lan",
iifname { "infrastructure" } oifname { "podman0", "vb-omada" } counter accept "infrastructure",
"vb-*",
"podman0",
"multimedia",
"smart",
"wg_cloonar",
} oifname {
"wan",
} counter accept comment "Allow trusted LAN to WAN"
}
'';
};
"cloonar-nat" = {
family = "ip";
content = ''
chain prerouting {
type nat hook prerouting priority filter; policy accept;
}
# Allow trusted network WAN access # Setup NAT masquerading on external interfaces
iifname { chain postrouting {
"lan", type nat hook postrouting priority filter; policy accept;
"infrastructure", oifname { "wan", "wrwks", "wg_epicenter", "wg_ghetto_at" } masquerade
"vb-*", # iifname { "vb-*" } oifname { "server" } masquerade comment "from internal interfaces"
"podman0", }
"multimedia", ''
"smart", };
"wg_cloonar", };
} oifname {
"wan",
} counter accept comment "Allow trusted LAN to WAN"
}
}
table ip nat {
chain prerouting {
type nat hook prerouting priority filter; policy accept;
}
# Setup NAT masquerading on external interfaces
chain postrouting {
type nat hook postrouting priority filter; policy accept;
oifname { "wan", "wrwks", "wg_epicenter", "wg_ghetto_at" } masquerade
iifname { "vb-*" } oifname { "server" } masquerade comment "from internal interfaces"
}
}
'';
}; };
}; };
} }