firewall for 23.05

hosts/fw.cloonar.com/modules/firewall.nix

@@ -3,10 +3,116 @@
     nat.enable = false;
     nftables = {
       enable = true;
-      tables = {
+      # tables = {
-        "cloonar-fw" = {
+      #   "cloonar-fw" = {
-          family = "inet";
+      #     family = "inet";
-          content = ''
+      #     content = ''
+      #       chain output {
+      #         type filter hook output priority 100; policy accept;
+      #       }
+      #
+      #       chain input {
+      #         type filter hook input priority filter; policy drop;
+      #
+      #         # accept any localhost traffic
+      #         iifname lo accept
+      #
+      #         # Allow trusted networks to access the router
+      #         iifname {
+      #           "wan", # disable when final
+      #           "lan",
+      #           "wg_cloonar"
+      #         } counter accept
+      #
+      #         # Allow networks to access the dns and dhcp
+      #         iifname {
+      #           "lan",
+      #           "vb-*",
+      #           "podman0",
+      #           "infrastructure",
+      #           "wg_cloonar",
+      #           "smart",
+      #           "multimedia"
+      #         } udp dport { 53, 67, 68 } counter accept
+      #         iifname {
+      #           "lan",
+      #           "podman0",
+      #           "vb-*",
+      #           "infrastructure",
+      #           "wg_cloonar",
+      #           "smart",
+      #           "multimedia"
+      #         } tcp dport { 80, 443, 853 } counter accept
+      #
+      #         # Accept mDNS for avahi reflection
+      #         # iifname "multimedia" ip saddr <chromecast IP> tcp dport { llmnr } counter accept
+      #         # iifname "multimedia" ip saddr <chromecast IP> udp dport { mdns, llmnr } counter accept
+      #
+      #         # Allow returning traffic from wg_cloonar and drop everthing else
+      #         iifname "wg_cloonar" ct state { established, related } counter accept
+      #         iifname "wg_cloonar" drop
+      #
+      #         iifname "wan" ct state { established, related } accept comment "Allow established traffic"
+      #         iifname "wan" icmp type { echo-request, destination-unreachable, time-exceeded } counter accept comment "Allow select ICMP"
+      #         iifname "wan" counter drop comment "Drop all other unsolicited traffic from wan"
+      #       }
+      #
+      #       chain forward {
+      #         type filter hook forward priority filter; policy drop;
+      #
+      #         # enable flow offloading for better throughput
+      #         # ip protocol { tcp, udp } flow offload @f
+      #
+      #         # multimedia airplay
+      #         iifname "multimedia" oifname { "lan" } counter accept
+      #
+      #         # lan and vpn to any
+      #         # TODO: disable wan when finished
+      #         iifname { "wan", "lan", "vb-*", "podman0", "wg_cloonar" } oifname { "lan", "vb-*", "podman0", "infrastructure", "multimedia", "smart", "wrwks", "wg_cloonar", "wg_epicenter", "wg_ghetto_at" } counter accept
+      #         iifname { "infrastructure" } oifname { "podman0", "vb-omada" } counter accept
+      #
+      #         # Allow trusted network WAN access
+      #         iifname {
+      #           "lan",
+      #           "infrastructure",
+      #           "vb-*",
+      #           "podman0",
+      #           "multimedia",
+      #           "smart",
+      #           "wg_cloonar",
+      #         } oifname {
+      #           "wan",
+      #         } counter accept comment "Allow trusted LAN to WAN"
+      #       }
+      #     '';
+      #   };
+      #   "cloonar-nat" = {
+      #     family = "ip";
+      #     content = ''
+      #       chain prerouting {
+      #         type nat hook prerouting priority filter; policy accept;
+      #       }
+      #
+      #       # Setup NAT masquerading on external interfaces
+      #       chain postrouting {
+      #         type nat hook postrouting priority filter; policy accept;
+      #         oifname { "wan", "wrwks", "wg_epicenter", "wg_ghetto_at" } masquerade
+      #         # iifname { "vb-*" } oifname { "server" } masquerade comment "from internal interfaces"
+      #       }
+      #     ''
+      #   };
+      # };
+    };
+    nftables = {
+      enable = true;
+      ruleset = ''
+        table inet filter {
+          # enable flow offloading for better throughput
+          # flowtable f {
+          #   hook ingress priority 0;
+          #   devices = { lan, server, wg_cloonar, smart, multimedia, guest };
+          # }
+
           chain output {
             type filter hook output priority 100; policy accept;
           }
@@ -84,11 +190,9 @@
               "wan",
             } counter accept comment "Allow trusted LAN to WAN"
           }
-          '';
+        }
-        };
+
-        "cloonar-nat" = {
+        table ip nat {
-          family = "ip";
-          content = ''
           chain prerouting {
             type nat hook prerouting priority filter; policy accept;
           }
@@ -99,9 +203,8 @@
             oifname { "wan", "wrwks", "wg_epicenter", "wg_ghetto_at" } masquerade
             # iifname { "vb-*" } oifname { "server" } masquerade comment "from internal interfaces"
           }
+        }
       '';
     };
   };
-    };
-  };
 }