firewall for 23.05
This commit is contained in:
@@ -3,105 +3,208 @@
|
||||
nat.enable = false;
|
||||
nftables = {
|
||||
enable = true;
|
||||
tables = {
|
||||
"cloonar-fw" = {
|
||||
family = "inet";
|
||||
content = ''
|
||||
chain output {
|
||||
type filter hook output priority 100; policy accept;
|
||||
}
|
||||
# tables = {
|
||||
# "cloonar-fw" = {
|
||||
# family = "inet";
|
||||
# content = ''
|
||||
# chain output {
|
||||
# type filter hook output priority 100; policy accept;
|
||||
# }
|
||||
#
|
||||
# chain input {
|
||||
# type filter hook input priority filter; policy drop;
|
||||
#
|
||||
# # accept any localhost traffic
|
||||
# iifname lo accept
|
||||
#
|
||||
# # Allow trusted networks to access the router
|
||||
# iifname {
|
||||
# "wan", # disable when final
|
||||
# "lan",
|
||||
# "wg_cloonar"
|
||||
# } counter accept
|
||||
#
|
||||
# # Allow networks to access the dns and dhcp
|
||||
# iifname {
|
||||
# "lan",
|
||||
# "vb-*",
|
||||
# "podman0",
|
||||
# "infrastructure",
|
||||
# "wg_cloonar",
|
||||
# "smart",
|
||||
# "multimedia"
|
||||
# } udp dport { 53, 67, 68 } counter accept
|
||||
# iifname {
|
||||
# "lan",
|
||||
# "podman0",
|
||||
# "vb-*",
|
||||
# "infrastructure",
|
||||
# "wg_cloonar",
|
||||
# "smart",
|
||||
# "multimedia"
|
||||
# } tcp dport { 80, 443, 853 } counter accept
|
||||
#
|
||||
# # Accept mDNS for avahi reflection
|
||||
# # iifname "multimedia" ip saddr <chromecast IP> tcp dport { llmnr } counter accept
|
||||
# # iifname "multimedia" ip saddr <chromecast IP> udp dport { mdns, llmnr } counter accept
|
||||
#
|
||||
# # Allow returning traffic from wg_cloonar and drop everthing else
|
||||
# iifname "wg_cloonar" ct state { established, related } counter accept
|
||||
# iifname "wg_cloonar" drop
|
||||
#
|
||||
# iifname "wan" ct state { established, related } accept comment "Allow established traffic"
|
||||
# iifname "wan" icmp type { echo-request, destination-unreachable, time-exceeded } counter accept comment "Allow select ICMP"
|
||||
# iifname "wan" counter drop comment "Drop all other unsolicited traffic from wan"
|
||||
# }
|
||||
#
|
||||
# chain forward {
|
||||
# type filter hook forward priority filter; policy drop;
|
||||
#
|
||||
# # enable flow offloading for better throughput
|
||||
# # ip protocol { tcp, udp } flow offload @f
|
||||
#
|
||||
# # multimedia airplay
|
||||
# iifname "multimedia" oifname { "lan" } counter accept
|
||||
#
|
||||
# # lan and vpn to any
|
||||
# # TODO: disable wan when finished
|
||||
# iifname { "wan", "lan", "vb-*", "podman0", "wg_cloonar" } oifname { "lan", "vb-*", "podman0", "infrastructure", "multimedia", "smart", "wrwks", "wg_cloonar", "wg_epicenter", "wg_ghetto_at" } counter accept
|
||||
# iifname { "infrastructure" } oifname { "podman0", "vb-omada" } counter accept
|
||||
#
|
||||
# # Allow trusted network WAN access
|
||||
# iifname {
|
||||
# "lan",
|
||||
# "infrastructure",
|
||||
# "vb-*",
|
||||
# "podman0",
|
||||
# "multimedia",
|
||||
# "smart",
|
||||
# "wg_cloonar",
|
||||
# } oifname {
|
||||
# "wan",
|
||||
# } counter accept comment "Allow trusted LAN to WAN"
|
||||
# }
|
||||
# '';
|
||||
# };
|
||||
# "cloonar-nat" = {
|
||||
# family = "ip";
|
||||
# content = ''
|
||||
# chain prerouting {
|
||||
# type nat hook prerouting priority filter; policy accept;
|
||||
# }
|
||||
#
|
||||
# # Setup NAT masquerading on external interfaces
|
||||
# chain postrouting {
|
||||
# type nat hook postrouting priority filter; policy accept;
|
||||
# oifname { "wan", "wrwks", "wg_epicenter", "wg_ghetto_at" } masquerade
|
||||
# # iifname { "vb-*" } oifname { "server" } masquerade comment "from internal interfaces"
|
||||
# }
|
||||
# ''
|
||||
# };
|
||||
# };
|
||||
};
|
||||
nftables = {
|
||||
enable = true;
|
||||
ruleset = ''
|
||||
table inet filter {
|
||||
# enable flow offloading for better throughput
|
||||
# flowtable f {
|
||||
# hook ingress priority 0;
|
||||
# devices = { lan, server, wg_cloonar, smart, multimedia, guest };
|
||||
# }
|
||||
|
||||
chain input {
|
||||
type filter hook input priority filter; policy drop;
|
||||
chain output {
|
||||
type filter hook output priority 100; policy accept;
|
||||
}
|
||||
|
||||
# accept any localhost traffic
|
||||
iifname lo accept
|
||||
chain input {
|
||||
type filter hook input priority filter; policy drop;
|
||||
|
||||
# Allow trusted networks to access the router
|
||||
iifname {
|
||||
"wan", # disable when final
|
||||
"lan",
|
||||
"wg_cloonar"
|
||||
} counter accept
|
||||
# accept any localhost traffic
|
||||
iifname lo accept
|
||||
|
||||
# Allow networks to access the dns and dhcp
|
||||
iifname {
|
||||
"lan",
|
||||
"vb-*",
|
||||
"podman0",
|
||||
"infrastructure",
|
||||
"wg_cloonar",
|
||||
"smart",
|
||||
"multimedia"
|
||||
} udp dport { 53, 67, 68 } counter accept
|
||||
iifname {
|
||||
"lan",
|
||||
"podman0",
|
||||
"vb-*",
|
||||
"infrastructure",
|
||||
"wg_cloonar",
|
||||
"smart",
|
||||
"multimedia"
|
||||
} tcp dport { 80, 443, 853 } counter accept
|
||||
# Allow trusted networks to access the router
|
||||
iifname {
|
||||
"wan", # disable when final
|
||||
"lan",
|
||||
"wg_cloonar"
|
||||
} counter accept
|
||||
|
||||
# Accept mDNS for avahi reflection
|
||||
# iifname "multimedia" ip saddr <chromecast IP> tcp dport { llmnr } counter accept
|
||||
# iifname "multimedia" ip saddr <chromecast IP> udp dport { mdns, llmnr } counter accept
|
||||
# Allow networks to access the dns and dhcp
|
||||
iifname {
|
||||
"lan",
|
||||
"vb-*",
|
||||
"podman0",
|
||||
"infrastructure",
|
||||
"wg_cloonar",
|
||||
"smart",
|
||||
"multimedia"
|
||||
} udp dport { 53, 67, 68 } counter accept
|
||||
iifname {
|
||||
"lan",
|
||||
"podman0",
|
||||
"vb-*",
|
||||
"infrastructure",
|
||||
"wg_cloonar",
|
||||
"smart",
|
||||
"multimedia"
|
||||
} tcp dport { 80, 443, 853 } counter accept
|
||||
|
||||
# Allow returning traffic from wg_cloonar and drop everthing else
|
||||
iifname "wg_cloonar" ct state { established, related } counter accept
|
||||
iifname "wg_cloonar" drop
|
||||
# Accept mDNS for avahi reflection
|
||||
# iifname "multimedia" ip saddr <chromecast IP> tcp dport { llmnr } counter accept
|
||||
# iifname "multimedia" ip saddr <chromecast IP> udp dport { mdns, llmnr } counter accept
|
||||
|
||||
iifname "wan" ct state { established, related } accept comment "Allow established traffic"
|
||||
iifname "wan" icmp type { echo-request, destination-unreachable, time-exceeded } counter accept comment "Allow select ICMP"
|
||||
iifname "wan" counter drop comment "Drop all other unsolicited traffic from wan"
|
||||
}
|
||||
# Allow returning traffic from wg_cloonar and drop everthing else
|
||||
iifname "wg_cloonar" ct state { established, related } counter accept
|
||||
iifname "wg_cloonar" drop
|
||||
|
||||
chain forward {
|
||||
type filter hook forward priority filter; policy drop;
|
||||
iifname "wan" ct state { established, related } accept comment "Allow established traffic"
|
||||
iifname "wan" icmp type { echo-request, destination-unreachable, time-exceeded } counter accept comment "Allow select ICMP"
|
||||
iifname "wan" counter drop comment "Drop all other unsolicited traffic from wan"
|
||||
}
|
||||
|
||||
# enable flow offloading for better throughput
|
||||
# ip protocol { tcp, udp } flow offload @f
|
||||
chain forward {
|
||||
type filter hook forward priority filter; policy drop;
|
||||
|
||||
# multimedia airplay
|
||||
iifname "multimedia" oifname { "lan" } counter accept
|
||||
# enable flow offloading for better throughput
|
||||
# ip protocol { tcp, udp } flow offload @f
|
||||
|
||||
# lan and vpn to any
|
||||
# TODO: disable wan when finished
|
||||
iifname { "wan", "lan", "vb-*", "podman0", "wg_cloonar" } oifname { "lan", "vb-*", "podman0", "infrastructure", "multimedia", "smart", "wrwks", "wg_cloonar", "wg_epicenter", "wg_ghetto_at" } counter accept
|
||||
iifname { "infrastructure" } oifname { "podman0", "vb-omada" } counter accept
|
||||
# multimedia airplay
|
||||
iifname "multimedia" oifname { "lan" } counter accept
|
||||
|
||||
# Allow trusted network WAN access
|
||||
iifname {
|
||||
"lan",
|
||||
"infrastructure",
|
||||
"vb-*",
|
||||
"podman0",
|
||||
"multimedia",
|
||||
"smart",
|
||||
"wg_cloonar",
|
||||
} oifname {
|
||||
"wan",
|
||||
} counter accept comment "Allow trusted LAN to WAN"
|
||||
}
|
||||
'';
|
||||
};
|
||||
"cloonar-nat" = {
|
||||
family = "ip";
|
||||
content = ''
|
||||
chain prerouting {
|
||||
type nat hook prerouting priority filter; policy accept;
|
||||
}
|
||||
# lan and vpn to any
|
||||
# TODO: disable wan when finished
|
||||
iifname { "wan", "lan", "vb-*", "podman0", "wg_cloonar" } oifname { "lan", "vb-*", "podman0", "infrastructure", "multimedia", "smart", "wrwks", "wg_cloonar", "wg_epicenter", "wg_ghetto_at" } counter accept
|
||||
iifname { "infrastructure" } oifname { "podman0", "vb-omada" } counter accept
|
||||
|
||||
# Setup NAT masquerading on external interfaces
|
||||
chain postrouting {
|
||||
type nat hook postrouting priority filter; policy accept;
|
||||
oifname { "wan", "wrwks", "wg_epicenter", "wg_ghetto_at" } masquerade
|
||||
# iifname { "vb-*" } oifname { "server" } masquerade comment "from internal interfaces"
|
||||
}
|
||||
'';
|
||||
};
|
||||
};
|
||||
# Allow trusted network WAN access
|
||||
iifname {
|
||||
"lan",
|
||||
"infrastructure",
|
||||
"vb-*",
|
||||
"podman0",
|
||||
"multimedia",
|
||||
"smart",
|
||||
"wg_cloonar",
|
||||
} oifname {
|
||||
"wan",
|
||||
} counter accept comment "Allow trusted LAN to WAN"
|
||||
}
|
||||
}
|
||||
|
||||
table ip nat {
|
||||
chain prerouting {
|
||||
type nat hook prerouting priority filter; policy accept;
|
||||
}
|
||||
|
||||
# Setup NAT masquerading on external interfaces
|
||||
chain postrouting {
|
||||
type nat hook postrouting priority filter; policy accept;
|
||||
oifname { "wan", "wrwks", "wg_epicenter", "wg_ghetto_at" } masquerade
|
||||
# iifname { "vb-*" } oifname { "server" } masquerade comment "from internal interfaces"
|
||||
}
|
||||
}
|
||||
'';
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user