change to firewall and dns

This commit is contained in:
2024-02-18 22:39:34 +01:00
parent 57a215fec4
commit 802fcbd47f
4 changed files with 115 additions and 282 deletions

View File

@@ -167,6 +167,13 @@
data = "10.42.99.1"; data = "10.42.99.1";
} }
]; ];
reservations = [
{
hw-address = "c4:a7:2b:c7:ea:30";
ip-address = "10.42.97.10";
server-hostname = "metz.cloonar.com";
}
];
} }
{ {
pools = [ pools = [

View File

@@ -2,313 +2,135 @@
networking = { networking = {
firewall.checkReversePath = false; firewall.checkReversePath = false;
nat.enable = false; nat.enable = false;
# nftables = {
# enable = true;
# tables = {
# "cloonar-fw" = {
# family = "inet";
# content = ''
# chain output {
# type filter hook output priority 100; policy accept;
# }
#
# chain input {
# type filter hook input priority filter; policy drop;
#
# # accept any localhost traffic
# iifname lo accept
#
# # Allow trusted networks to access the router
# iifname {
# "wan", # disable when final
# "lan",
# "wg_cloonar"
# } counter accept
#
# # Allow networks to access the dns and dhcp
# iifname {
# "lan",
# "vb-*",
# "podman0",
# "infrastructure",
# "wg_cloonar",
# "smart",
# "multimedia"
# } udp dport { 53, 67, 68 } counter accept
# iifname {
# "lan",
# "podman0",
# "vb-*",
# "infrastructure",
# "wg_cloonar",
# "smart",
# "multimedia"
# } tcp dport { 80, 443, 853 } counter accept
#
# # Accept mDNS for avahi reflection
# # iifname "multimedia" ip saddr <chromecast IP> tcp dport { llmnr } counter accept
# # iifname "multimedia" ip saddr <chromecast IP> udp dport { mdns, llmnr } counter accept
#
# # Allow returning traffic from wg_cloonar and drop everthing else
# iifname "wg_cloonar" ct state { established, related } counter accept
# iifname "wg_cloonar" drop
#
# iifname "wan" ct state { established, related } accept comment "Allow established traffic"
# iifname "wan" icmp type { echo-request, destination-unreachable, time-exceeded } counter accept comment "Allow select ICMP"
# iifname "wan" counter drop comment "Drop all other unsolicited traffic from wan"
# }
#
# chain forward {
# type filter hook forward priority filter; policy drop;
#
# # enable flow offloading for better throughput
# # ip protocol { tcp, udp } flow offload @f
#
# # multimedia airplay
# iifname "multimedia" oifname { "lan" } counter accept
#
# # lan and vpn to any
# # TODO: disable wan when finished
# iifname { "wan", "lan", "vb-*", "podman0", "wg_cloonar" } oifname { "lan", "vb-*", "podman0", "infrastructure", "multimedia", "smart", "wrwks", "wg_cloonar", "wg_epicenter", "wg_ghetto_at" } counter accept
# iifname { "infrastructure" } oifname { "podman0", "vb-omada" } counter accept
#
# # Allow trusted network WAN access
# iifname {
# "lan",
# "infrastructure",
# "vb-*",
# "podman0",
# "multimedia",
# "smart",
# "wg_cloonar",
# } oifname {
# "wan",
# } counter accept comment "Allow trusted LAN to WAN"
# }
# '';
# };
# "cloonar-nat" = {
# family = "ip";
# content = ''
# chain prerouting {
# type nat hook prerouting priority filter; policy accept;
# }
#
# # Setup NAT masquerading on external interfaces
# chain postrouting {
# type nat hook postrouting priority filter; policy accept;
# oifname { "wan", "wrwks", "wg_epicenter", "wg_ghetto_at" } masquerade
# # iifname { "vb-*" } oifname { "server" } masquerade comment "from internal interfaces"
# }
# ''
# };
# };
# };
nftables = { nftables = {
enable = true; enable = true;
ruleset = '' tables = {
table inet filter { "cloonar-fw" = {
# enable flow offloading for better throughput family = "inet";
# flowtable f { content = ''
# hook ingress priority 0; chain output {
# devices = { lan, server, wg_cloonar, smart, multimedia, guest }; type filter hook output priority 100; policy accept;
# } }
chain output { chain rpfilter {
type filter hook output priority 100; policy accept; type filter hook prerouting priority mangle + 10; policy drop;
} meta nfproto ipv4 udp sport . udp dport { 68 . 67, 67 . 68 } accept comment "DHCPv4 client/server"
fib saddr . mark . iif oif exists accept
}
chain rpfilter { chain input {
type filter hook prerouting priority mangle + 10; policy drop; type filter hook input priority filter; policy drop;
meta nfproto ipv4 udp sport . udp dport { 68 . 67, 67 . 68 } accept comment "DHCPv4 client/server" iifname "lo" accept comment "trusted interfaces"
fib saddr . mark . iif oif exists accept ct state vmap { invalid : drop, established : accept, related : accept, new : jump input-allow, untracked : jump input-allow }
} tcp flags syn / fin,syn,rst,ack log prefix "refused connection: " level info
}
chain input { chain input-allow {
type filter hook input priority filter; policy drop; udp dport != { 53, 5353 } ct state new limit rate over 1/second burst 10 packets drop comment "rate limit for new connections"
iifname "lo" accept comment "trusted interfaces" iifname lo accept
ct state vmap { invalid : drop, established : accept, related : accept, new : jump input-allow, untracked : jump input-allow } iifname "wan" udp dport 51820 counter accept comment "Wireguard traffic"
tcp flags syn / fin,syn,rst,ack log prefix "refused connection: " level info iifname { "server", "vserver", "lan", "wg_cloonar" } counter accept comment "allow trusted to router"
} iifname { "multimedia", "smart" } udp dport { 53, 5353 } counter accept comment "DNS"
chain input-allow { # Accept mDNS for avahi reflection
iifname "wan" udp dport 51820 counter accept comment "Wireguard traffic" iifname "server" ip saddr 10.42.97.20/32 tcp dport { llmnr } counter accept
iifname "server" ip saddr 10.42.97.20/32 udp dport { mdns, llmnr } counter accept
iifname "wg_cloonar" counter accept comment "test wireguard" # Allow all returning traffic
ct state { established, related } counter accept
# drop new connections over rate limit # Allow returning traffic from wrwks and drop everthing else
udp dport != { 53, 5353 } ct state new limit rate over 1/second burst 10 packets drop iifname "wrwks" ct state { established, related } counter accept
iifname "wrwks" drop
# accept any localhost traffic # Allow returning traffic from wg_epicenter and drop everthing else
iifname lo accept iifname "wg_epicenter" ct state { established, related } counter accept
iifname "wg_epicenter" drop
# Allow trusted networks to access the router # Allow returning traffic from wg_ghetto_at and drop everthing else
iifname { iifname "wg_ghetto_at" ct state { established, related } counter accept
"wg_cloonar" iifname "wg_ghetto_at" drop
} counter accept
iifname {
"server",
"vserver",
"lan",
} counter accept
# Allow networks to access dhcp # Allow returning traffic from wan and drop everthing else
iifname { iifname "wan" ct state { established, related } accept comment "Allow established traffic"
"lan", iifname "wan" icmp type { echo-request, destination-unreachable, time-exceeded } counter accept comment "Allow select ICMP"
"server", iifname "wan" counter drop comment "Drop all other unsolicited traffic from wan"
"vserver",
"infrastructure",
"smart",
"podman*",
"multimedia"
} udp dport { 67, 68 } counter accept
# Allow networks to access dns limit rate 60/minute burst 100 packets log prefix "Input - Drop: " comment "Log any unmatched traffic"
iifname { }
"lan",
"server",
"vserver",
"infrastructure",
"smart",
"podman*",
"multimedia"
} udp dport { 53 } counter accept
chain forward {
type filter hook forward priority filter; policy drop;
# allow audio system to access snapserver iifname "wg_cloonar" counter accept comment "test wireguard"
iifname {
"server",
"smart",
"multimedia"
} tcp dport { 1704, 1705 } counter accept
# allow airplay access
iifname "lan" tcp dport { 5000, 5353 } counter accept
iifname "lan" udp dport { 5000, 5353, 6001 - 6011 } counter accept
# Accept mDNS for avahi reflection iifname "wg_cloonar" oifname lo counter accept comment "wireguard to server"
iifname "server" ip saddr 10.42.97.20/32 tcp dport { llmnr } counter accept
iifname "server" ip saddr 10.42.97.20/32 udp dport { mdns, llmnr } counter accept
# accept palword server # enable flow offloading for better throughput
iifname { "wan", "lan" } udp dport { 8211, 27015 } counter accept # ip protocol { tcp, udp } flow offload @f
# Allow all returning traffic # multimedia airplay
ct state { established, related } counter accept iifname "multimedia" oifname { "lan" } counter accept
iifname "multimedia" oifname "server" tcp dport { 1704, 1705 } counter accept
iifname "lan" oifname "server" udp dport { 5000, 5353, 6001 - 6011 } counter accept
# avahi
iifname "server" ip saddr 10.42.97.20/32 oifname { "lan" } counter accept
# Allow returning traffic from wrwks and drop everthing else # smart home coap
iifname "wrwks" ct state { established, related } counter accept iifname "smart" oifname "server" ip daddr 10.42.97.20/32 udp dport { 5683 } counter accept
iifname "wrwks" drop
# Allow returning traffic from wg_epicenter and drop everthing else # Forward to git server
iifname "wg_epicenter" ct state { established, related } counter accept oifname "server" ip daddr 10.42.97.50 tcp dport { 22, 80, 443 } counter accept
iifname "wg_epicenter" drop
# Allow returning traffic from wg_ghetto_at and drop everthing else # lan and vpn to any
iifname "wg_ghetto_at" ct state { established, related } counter accept # TODO: disable wan when finished
iifname "wg_ghetto_at" drop iifname { "lan", "server", "vserver", "wg_cloonar" } oifname { "lan", "vb-*", "server", "vserver", "infrastructure", "multimedia", "smart", "wg_cloonar" } counter accept
iifname { "lan", "server", "wg_cloonar" } oifname { "wrwks", "wg_epicenter", "wg_ghetto_at" } counter accept
iifname { "infrastructure" } oifname { "server", "vserver" } counter accept
# Allow returning traffic from wan and drop everthing else # accept palword server
iifname "wan" ct state { established, related } accept comment "Allow established traffic" iifname { "wan", "lan" } oifname "podman0" udp dport { 8211, 27015 } counter accept
iifname "wan" icmp type { echo-request, destination-unreachable, time-exceeded } counter accept comment "Allow select ICMP"
iifname "wan" counter drop comment "Drop all other unsolicited traffic from wan"
limit rate 60/minute burst 100 packets log prefix "Input - Drop: " comment "Log any unmatched traffic" # allow all established, related
} ct state { established, related } accept comment "Allow established traffic"
chain forward { # Allow trusted network WAN access
type filter hook forward priority filter; policy drop; iifname {
"lan",
"infrastructure",
"server",
"vserver",
"multimedia",
"smart",
"wg_cloonar",
"podman*",
"guest",
"vb-*",
} oifname {
"wan",
} counter accept comment "Allow trusted LAN to WAN"
iifname "wg_cloonar" counter accept comment "test wireguard" limit rate 60/minute burst 100 packets log prefix "Forward - Drop: " comment "Log any unmatched traffic"
}
'';
};
"cloonar-nat" = {
family = "ip";
content = ''
chain prerouting {
type nat hook prerouting priority filter; policy accept;
iifname "wan" tcp dport { 22, 80, 443 } dnat to 10.42.97.50
}
iifname "wg_cloonar" oifname lo counter accept comment "wireguard to server" # Setup NAT masquerading on external interfaces
chain postrouting {
# enable flow offloading for better throughput type nat hook postrouting priority filter; policy accept;
# ip protocol { tcp, udp } flow offload @f oifname { "wan", "wg_cloonar", "wrwks", "wg_epicenter", "wg_ghetto_at" } masquerade
ip daddr 10.42.97.50 masquerade
# multimedia airplay }
iifname "multimedia" oifname { "lan" } counter accept '';
iifname "multimedia" oifname "server" tcp dport { 1704, 1705 } counter accept };
iifname "lan" oifname "server" udp dport { 5000, 5353, 6001 - 6011 } counter accept
# avahi
iifname "server" ip saddr 10.42.97.20/32 oifname { "lan" } counter accept
# smart home coap
iifname "smart" oifname "server" ip daddr 10.42.97.20/32 udp dport { 5683 } counter accept
# Forward to git server
oifname "server" ip daddr 10.42.97.50 tcp dport { 22, 80, 443 } counter accept
# lan and vpn to any
# TODO: disable wan when finished
iifname { "lan", "server", "vserver", "wg_cloonar" } oifname { "lan", "vb-*", "server", "vserver", "infrastructure", "multimedia", "smart", "wg_cloonar" } counter accept
iifname { "lan", "server", "wg_cloonar" } oifname { "wrwks", "wg_epicenter", "wg_ghetto_at" } counter accept
iifname { "infrastructure" } oifname { "server", "vserver" } counter accept
# accept palword server
iifname { "wan", "lan" } oifname "podman0" udp dport { 8211, 27015 } counter accept
# allow all established, related
ct state { established, related } accept comment "Allow established traffic"
# Allow trusted network WAN access
iifname {
"lan",
"infrastructure",
"server",
"vserver",
"multimedia",
"smart",
"wg_cloonar",
"podman*",
"guest",
"vb-*",
"ve-*",
} oifname {
"wan",
} counter accept comment "Allow trusted LAN to WAN"
limit rate 60/minute burst 100 packets log prefix "Forward - Drop: " comment "Log any unmatched traffic"
}
}
table ip nat {
chain prerouting {
type nat hook prerouting priority filter; policy accept;
iifname "wan" tcp dport { 22, 80, 443 } dnat to 10.42.97.50
}
# Setup NAT masquerading on external interfaces
chain postrouting {
type nat hook postrouting priority filter; policy accept;
oifname { "wan", "wg_cloonar", "wrwks", "wg_epicenter", "wg_ghetto_at" } masquerade
ip daddr 10.42.97.50 masquerade
}
}
'';
};
};
systemd.services.nftables-fix = {
description = "Delete nixos-fw table";
after = [ "nftables.service" ];
serviceConfig = let
fixScript = pkgs.writeTextFile {
name = "nftables-fix";
executable = true;
text = ''
#! ${pkgs.nftables}/bin/nft -f
delete table inet nixos-fw
'';
}; };
in {
Name = "nftables-fix";
PartOf = "nftables.service";
Type = "oneshot";
ExecStart= [ fixScript ];
StateDirectory = "nftables";
}; };
}; };
} }

View File

@@ -73,7 +73,7 @@ let
"\"upgrade-staging.wienbautvor.at IN A 10.254.240.110\"" "\"upgrade-staging.wienbautvor.at IN A 10.254.240.110\""
"\"upgrade-staging.wienwohntbesser.at IN A 10.254.240.110\"" "\"upgrade-staging.wienwohntbesser.at IN A 10.254.240.110\""
"\"metz.cloonar.com IN A 10.42.96.167\"" "\"metz.cloonar.com IN A 10.42.99.10\""
"\"firetv-living.cloonar.com IN A 10.42.96.175\"" "\"firetv-living.cloonar.com IN A 10.42.96.175\""
"\"ps5-living.cloonar.com IN A 10.42.96.176\"" "\"ps5-living.cloonar.com IN A 10.42.96.176\""
@@ -220,4 +220,6 @@ in {
partOf = [ "unbound.service" ]; partOf = [ "unbound.service" ];
wantedBy = [ "multi-user.target" ]; wantedBy = [ "multi-user.target" ];
}; };
networking.firewall.allowedUDPPorts = [ 53 5353 ];
} }

View File

@@ -48,4 +48,6 @@
]; ];
}; };
}; };
networking.firewall.allowedUDPPorts = [ 51820 ];
} }