change to firewall and dns
This commit is contained in:
@@ -167,6 +167,13 @@
|
|||||||
data = "10.42.99.1";
|
data = "10.42.99.1";
|
||||||
}
|
}
|
||||||
];
|
];
|
||||||
|
reservations = [
|
||||||
|
{
|
||||||
|
hw-address = "c4:a7:2b:c7:ea:30";
|
||||||
|
ip-address = "10.42.97.10";
|
||||||
|
server-hostname = "metz.cloonar.com";
|
||||||
|
}
|
||||||
|
];
|
||||||
}
|
}
|
||||||
{
|
{
|
||||||
pools = [
|
pools = [
|
||||||
|
|||||||
@@ -2,313 +2,135 @@
|
|||||||
networking = {
|
networking = {
|
||||||
firewall.checkReversePath = false;
|
firewall.checkReversePath = false;
|
||||||
nat.enable = false;
|
nat.enable = false;
|
||||||
# nftables = {
|
|
||||||
# enable = true;
|
|
||||||
# tables = {
|
|
||||||
# "cloonar-fw" = {
|
|
||||||
# family = "inet";
|
|
||||||
# content = ''
|
|
||||||
# chain output {
|
|
||||||
# type filter hook output priority 100; policy accept;
|
|
||||||
# }
|
|
||||||
#
|
|
||||||
# chain input {
|
|
||||||
# type filter hook input priority filter; policy drop;
|
|
||||||
#
|
|
||||||
# # accept any localhost traffic
|
|
||||||
# iifname lo accept
|
|
||||||
#
|
|
||||||
# # Allow trusted networks to access the router
|
|
||||||
# iifname {
|
|
||||||
# "wan", # disable when final
|
|
||||||
# "lan",
|
|
||||||
# "wg_cloonar"
|
|
||||||
# } counter accept
|
|
||||||
#
|
|
||||||
# # Allow networks to access the dns and dhcp
|
|
||||||
# iifname {
|
|
||||||
# "lan",
|
|
||||||
# "vb-*",
|
|
||||||
# "podman0",
|
|
||||||
# "infrastructure",
|
|
||||||
# "wg_cloonar",
|
|
||||||
# "smart",
|
|
||||||
# "multimedia"
|
|
||||||
# } udp dport { 53, 67, 68 } counter accept
|
|
||||||
# iifname {
|
|
||||||
# "lan",
|
|
||||||
# "podman0",
|
|
||||||
# "vb-*",
|
|
||||||
# "infrastructure",
|
|
||||||
# "wg_cloonar",
|
|
||||||
# "smart",
|
|
||||||
# "multimedia"
|
|
||||||
# } tcp dport { 80, 443, 853 } counter accept
|
|
||||||
#
|
|
||||||
# # Accept mDNS for avahi reflection
|
|
||||||
# # iifname "multimedia" ip saddr <chromecast IP> tcp dport { llmnr } counter accept
|
|
||||||
# # iifname "multimedia" ip saddr <chromecast IP> udp dport { mdns, llmnr } counter accept
|
|
||||||
#
|
|
||||||
# # Allow returning traffic from wg_cloonar and drop everthing else
|
|
||||||
# iifname "wg_cloonar" ct state { established, related } counter accept
|
|
||||||
# iifname "wg_cloonar" drop
|
|
||||||
#
|
|
||||||
# iifname "wan" ct state { established, related } accept comment "Allow established traffic"
|
|
||||||
# iifname "wan" icmp type { echo-request, destination-unreachable, time-exceeded } counter accept comment "Allow select ICMP"
|
|
||||||
# iifname "wan" counter drop comment "Drop all other unsolicited traffic from wan"
|
|
||||||
# }
|
|
||||||
#
|
|
||||||
# chain forward {
|
|
||||||
# type filter hook forward priority filter; policy drop;
|
|
||||||
#
|
|
||||||
# # enable flow offloading for better throughput
|
|
||||||
# # ip protocol { tcp, udp } flow offload @f
|
|
||||||
#
|
|
||||||
# # multimedia airplay
|
|
||||||
# iifname "multimedia" oifname { "lan" } counter accept
|
|
||||||
#
|
|
||||||
# # lan and vpn to any
|
|
||||||
# # TODO: disable wan when finished
|
|
||||||
# iifname { "wan", "lan", "vb-*", "podman0", "wg_cloonar" } oifname { "lan", "vb-*", "podman0", "infrastructure", "multimedia", "smart", "wrwks", "wg_cloonar", "wg_epicenter", "wg_ghetto_at" } counter accept
|
|
||||||
# iifname { "infrastructure" } oifname { "podman0", "vb-omada" } counter accept
|
|
||||||
#
|
|
||||||
# # Allow trusted network WAN access
|
|
||||||
# iifname {
|
|
||||||
# "lan",
|
|
||||||
# "infrastructure",
|
|
||||||
# "vb-*",
|
|
||||||
# "podman0",
|
|
||||||
# "multimedia",
|
|
||||||
# "smart",
|
|
||||||
# "wg_cloonar",
|
|
||||||
# } oifname {
|
|
||||||
# "wan",
|
|
||||||
# } counter accept comment "Allow trusted LAN to WAN"
|
|
||||||
# }
|
|
||||||
# '';
|
|
||||||
# };
|
|
||||||
# "cloonar-nat" = {
|
|
||||||
# family = "ip";
|
|
||||||
# content = ''
|
|
||||||
# chain prerouting {
|
|
||||||
# type nat hook prerouting priority filter; policy accept;
|
|
||||||
# }
|
|
||||||
#
|
|
||||||
# # Setup NAT masquerading on external interfaces
|
|
||||||
# chain postrouting {
|
|
||||||
# type nat hook postrouting priority filter; policy accept;
|
|
||||||
# oifname { "wan", "wrwks", "wg_epicenter", "wg_ghetto_at" } masquerade
|
|
||||||
# # iifname { "vb-*" } oifname { "server" } masquerade comment "from internal interfaces"
|
|
||||||
# }
|
|
||||||
# ''
|
|
||||||
# };
|
|
||||||
# };
|
|
||||||
# };
|
|
||||||
nftables = {
|
nftables = {
|
||||||
enable = true;
|
enable = true;
|
||||||
ruleset = ''
|
tables = {
|
||||||
table inet filter {
|
"cloonar-fw" = {
|
||||||
# enable flow offloading for better throughput
|
family = "inet";
|
||||||
# flowtable f {
|
content = ''
|
||||||
# hook ingress priority 0;
|
chain output {
|
||||||
# devices = { lan, server, wg_cloonar, smart, multimedia, guest };
|
type filter hook output priority 100; policy accept;
|
||||||
# }
|
}
|
||||||
|
|
||||||
chain output {
|
chain rpfilter {
|
||||||
type filter hook output priority 100; policy accept;
|
type filter hook prerouting priority mangle + 10; policy drop;
|
||||||
}
|
meta nfproto ipv4 udp sport . udp dport { 68 . 67, 67 . 68 } accept comment "DHCPv4 client/server"
|
||||||
|
fib saddr . mark . iif oif exists accept
|
||||||
|
}
|
||||||
|
|
||||||
chain rpfilter {
|
chain input {
|
||||||
type filter hook prerouting priority mangle + 10; policy drop;
|
type filter hook input priority filter; policy drop;
|
||||||
meta nfproto ipv4 udp sport . udp dport { 68 . 67, 67 . 68 } accept comment "DHCPv4 client/server"
|
iifname "lo" accept comment "trusted interfaces"
|
||||||
fib saddr . mark . iif oif exists accept
|
ct state vmap { invalid : drop, established : accept, related : accept, new : jump input-allow, untracked : jump input-allow }
|
||||||
}
|
tcp flags syn / fin,syn,rst,ack log prefix "refused connection: " level info
|
||||||
|
}
|
||||||
|
|
||||||
chain input {
|
chain input-allow {
|
||||||
type filter hook input priority filter; policy drop;
|
udp dport != { 53, 5353 } ct state new limit rate over 1/second burst 10 packets drop comment "rate limit for new connections"
|
||||||
iifname "lo" accept comment "trusted interfaces"
|
iifname lo accept
|
||||||
ct state vmap { invalid : drop, established : accept, related : accept, new : jump input-allow, untracked : jump input-allow }
|
iifname "wan" udp dport 51820 counter accept comment "Wireguard traffic"
|
||||||
tcp flags syn / fin,syn,rst,ack log prefix "refused connection: " level info
|
iifname { "server", "vserver", "lan", "wg_cloonar" } counter accept comment "allow trusted to router"
|
||||||
}
|
iifname { "multimedia", "smart" } udp dport { 53, 5353 } counter accept comment "DNS"
|
||||||
|
|
||||||
chain input-allow {
|
# Accept mDNS for avahi reflection
|
||||||
iifname "wan" udp dport 51820 counter accept comment "Wireguard traffic"
|
iifname "server" ip saddr 10.42.97.20/32 tcp dport { llmnr } counter accept
|
||||||
|
iifname "server" ip saddr 10.42.97.20/32 udp dport { mdns, llmnr } counter accept
|
||||||
|
|
||||||
iifname "wg_cloonar" counter accept comment "test wireguard"
|
# Allow all returning traffic
|
||||||
|
ct state { established, related } counter accept
|
||||||
|
|
||||||
# drop new connections over rate limit
|
# Allow returning traffic from wrwks and drop everthing else
|
||||||
udp dport != { 53, 5353 } ct state new limit rate over 1/second burst 10 packets drop
|
iifname "wrwks" ct state { established, related } counter accept
|
||||||
|
iifname "wrwks" drop
|
||||||
|
|
||||||
# accept any localhost traffic
|
# Allow returning traffic from wg_epicenter and drop everthing else
|
||||||
iifname lo accept
|
iifname "wg_epicenter" ct state { established, related } counter accept
|
||||||
|
iifname "wg_epicenter" drop
|
||||||
|
|
||||||
# Allow trusted networks to access the router
|
# Allow returning traffic from wg_ghetto_at and drop everthing else
|
||||||
iifname {
|
iifname "wg_ghetto_at" ct state { established, related } counter accept
|
||||||
"wg_cloonar"
|
iifname "wg_ghetto_at" drop
|
||||||
} counter accept
|
|
||||||
iifname {
|
|
||||||
"server",
|
|
||||||
"vserver",
|
|
||||||
"lan",
|
|
||||||
} counter accept
|
|
||||||
|
|
||||||
# Allow networks to access dhcp
|
# Allow returning traffic from wan and drop everthing else
|
||||||
iifname {
|
iifname "wan" ct state { established, related } accept comment "Allow established traffic"
|
||||||
"lan",
|
iifname "wan" icmp type { echo-request, destination-unreachable, time-exceeded } counter accept comment "Allow select ICMP"
|
||||||
"server",
|
iifname "wan" counter drop comment "Drop all other unsolicited traffic from wan"
|
||||||
"vserver",
|
|
||||||
"infrastructure",
|
|
||||||
"smart",
|
|
||||||
"podman*",
|
|
||||||
"multimedia"
|
|
||||||
} udp dport { 67, 68 } counter accept
|
|
||||||
|
|
||||||
# Allow networks to access dns
|
limit rate 60/minute burst 100 packets log prefix "Input - Drop: " comment "Log any unmatched traffic"
|
||||||
iifname {
|
}
|
||||||
"lan",
|
|
||||||
"server",
|
|
||||||
"vserver",
|
|
||||||
"infrastructure",
|
|
||||||
"smart",
|
|
||||||
"podman*",
|
|
||||||
"multimedia"
|
|
||||||
} udp dport { 53 } counter accept
|
|
||||||
|
|
||||||
|
chain forward {
|
||||||
|
type filter hook forward priority filter; policy drop;
|
||||||
|
|
||||||
# allow audio system to access snapserver
|
iifname "wg_cloonar" counter accept comment "test wireguard"
|
||||||
iifname {
|
|
||||||
"server",
|
|
||||||
"smart",
|
|
||||||
"multimedia"
|
|
||||||
} tcp dport { 1704, 1705 } counter accept
|
|
||||||
# allow airplay access
|
|
||||||
iifname "lan" tcp dport { 5000, 5353 } counter accept
|
|
||||||
iifname "lan" udp dport { 5000, 5353, 6001 - 6011 } counter accept
|
|
||||||
|
|
||||||
# Accept mDNS for avahi reflection
|
iifname "wg_cloonar" oifname lo counter accept comment "wireguard to server"
|
||||||
iifname "server" ip saddr 10.42.97.20/32 tcp dport { llmnr } counter accept
|
|
||||||
iifname "server" ip saddr 10.42.97.20/32 udp dport { mdns, llmnr } counter accept
|
|
||||||
|
|
||||||
# accept palword server
|
# enable flow offloading for better throughput
|
||||||
iifname { "wan", "lan" } udp dport { 8211, 27015 } counter accept
|
# ip protocol { tcp, udp } flow offload @f
|
||||||
|
|
||||||
# Allow all returning traffic
|
# multimedia airplay
|
||||||
ct state { established, related } counter accept
|
iifname "multimedia" oifname { "lan" } counter accept
|
||||||
|
iifname "multimedia" oifname "server" tcp dport { 1704, 1705 } counter accept
|
||||||
|
iifname "lan" oifname "server" udp dport { 5000, 5353, 6001 - 6011 } counter accept
|
||||||
|
# avahi
|
||||||
|
iifname "server" ip saddr 10.42.97.20/32 oifname { "lan" } counter accept
|
||||||
|
|
||||||
# Allow returning traffic from wrwks and drop everthing else
|
# smart home coap
|
||||||
iifname "wrwks" ct state { established, related } counter accept
|
iifname "smart" oifname "server" ip daddr 10.42.97.20/32 udp dport { 5683 } counter accept
|
||||||
iifname "wrwks" drop
|
|
||||||
|
|
||||||
# Allow returning traffic from wg_epicenter and drop everthing else
|
# Forward to git server
|
||||||
iifname "wg_epicenter" ct state { established, related } counter accept
|
oifname "server" ip daddr 10.42.97.50 tcp dport { 22, 80, 443 } counter accept
|
||||||
iifname "wg_epicenter" drop
|
|
||||||
|
|
||||||
# Allow returning traffic from wg_ghetto_at and drop everthing else
|
# lan and vpn to any
|
||||||
iifname "wg_ghetto_at" ct state { established, related } counter accept
|
# TODO: disable wan when finished
|
||||||
iifname "wg_ghetto_at" drop
|
iifname { "lan", "server", "vserver", "wg_cloonar" } oifname { "lan", "vb-*", "server", "vserver", "infrastructure", "multimedia", "smart", "wg_cloonar" } counter accept
|
||||||
|
iifname { "lan", "server", "wg_cloonar" } oifname { "wrwks", "wg_epicenter", "wg_ghetto_at" } counter accept
|
||||||
|
iifname { "infrastructure" } oifname { "server", "vserver" } counter accept
|
||||||
|
|
||||||
# Allow returning traffic from wan and drop everthing else
|
# accept palword server
|
||||||
iifname "wan" ct state { established, related } accept comment "Allow established traffic"
|
iifname { "wan", "lan" } oifname "podman0" udp dport { 8211, 27015 } counter accept
|
||||||
iifname "wan" icmp type { echo-request, destination-unreachable, time-exceeded } counter accept comment "Allow select ICMP"
|
|
||||||
iifname "wan" counter drop comment "Drop all other unsolicited traffic from wan"
|
|
||||||
|
|
||||||
limit rate 60/minute burst 100 packets log prefix "Input - Drop: " comment "Log any unmatched traffic"
|
# allow all established, related
|
||||||
}
|
ct state { established, related } accept comment "Allow established traffic"
|
||||||
|
|
||||||
chain forward {
|
# Allow trusted network WAN access
|
||||||
type filter hook forward priority filter; policy drop;
|
iifname {
|
||||||
|
"lan",
|
||||||
|
"infrastructure",
|
||||||
|
"server",
|
||||||
|
"vserver",
|
||||||
|
"multimedia",
|
||||||
|
"smart",
|
||||||
|
"wg_cloonar",
|
||||||
|
"podman*",
|
||||||
|
"guest",
|
||||||
|
"vb-*",
|
||||||
|
} oifname {
|
||||||
|
"wan",
|
||||||
|
} counter accept comment "Allow trusted LAN to WAN"
|
||||||
|
|
||||||
iifname "wg_cloonar" counter accept comment "test wireguard"
|
limit rate 60/minute burst 100 packets log prefix "Forward - Drop: " comment "Log any unmatched traffic"
|
||||||
|
}
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
"cloonar-nat" = {
|
||||||
|
family = "ip";
|
||||||
|
content = ''
|
||||||
|
chain prerouting {
|
||||||
|
type nat hook prerouting priority filter; policy accept;
|
||||||
|
iifname "wan" tcp dport { 22, 80, 443 } dnat to 10.42.97.50
|
||||||
|
}
|
||||||
|
|
||||||
iifname "wg_cloonar" oifname lo counter accept comment "wireguard to server"
|
# Setup NAT masquerading on external interfaces
|
||||||
|
chain postrouting {
|
||||||
# enable flow offloading for better throughput
|
type nat hook postrouting priority filter; policy accept;
|
||||||
# ip protocol { tcp, udp } flow offload @f
|
oifname { "wan", "wg_cloonar", "wrwks", "wg_epicenter", "wg_ghetto_at" } masquerade
|
||||||
|
ip daddr 10.42.97.50 masquerade
|
||||||
# multimedia airplay
|
}
|
||||||
iifname "multimedia" oifname { "lan" } counter accept
|
'';
|
||||||
iifname "multimedia" oifname "server" tcp dport { 1704, 1705 } counter accept
|
};
|
||||||
iifname "lan" oifname "server" udp dport { 5000, 5353, 6001 - 6011 } counter accept
|
|
||||||
# avahi
|
|
||||||
iifname "server" ip saddr 10.42.97.20/32 oifname { "lan" } counter accept
|
|
||||||
|
|
||||||
# smart home coap
|
|
||||||
iifname "smart" oifname "server" ip daddr 10.42.97.20/32 udp dport { 5683 } counter accept
|
|
||||||
|
|
||||||
# Forward to git server
|
|
||||||
oifname "server" ip daddr 10.42.97.50 tcp dport { 22, 80, 443 } counter accept
|
|
||||||
|
|
||||||
# lan and vpn to any
|
|
||||||
# TODO: disable wan when finished
|
|
||||||
iifname { "lan", "server", "vserver", "wg_cloonar" } oifname { "lan", "vb-*", "server", "vserver", "infrastructure", "multimedia", "smart", "wg_cloonar" } counter accept
|
|
||||||
iifname { "lan", "server", "wg_cloonar" } oifname { "wrwks", "wg_epicenter", "wg_ghetto_at" } counter accept
|
|
||||||
iifname { "infrastructure" } oifname { "server", "vserver" } counter accept
|
|
||||||
|
|
||||||
# accept palword server
|
|
||||||
iifname { "wan", "lan" } oifname "podman0" udp dport { 8211, 27015 } counter accept
|
|
||||||
|
|
||||||
# allow all established, related
|
|
||||||
ct state { established, related } accept comment "Allow established traffic"
|
|
||||||
|
|
||||||
# Allow trusted network WAN access
|
|
||||||
iifname {
|
|
||||||
"lan",
|
|
||||||
"infrastructure",
|
|
||||||
"server",
|
|
||||||
"vserver",
|
|
||||||
"multimedia",
|
|
||||||
"smart",
|
|
||||||
"wg_cloonar",
|
|
||||||
"podman*",
|
|
||||||
"guest",
|
|
||||||
"vb-*",
|
|
||||||
"ve-*",
|
|
||||||
} oifname {
|
|
||||||
"wan",
|
|
||||||
} counter accept comment "Allow trusted LAN to WAN"
|
|
||||||
|
|
||||||
limit rate 60/minute burst 100 packets log prefix "Forward - Drop: " comment "Log any unmatched traffic"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
table ip nat {
|
|
||||||
chain prerouting {
|
|
||||||
type nat hook prerouting priority filter; policy accept;
|
|
||||||
iifname "wan" tcp dport { 22, 80, 443 } dnat to 10.42.97.50
|
|
||||||
}
|
|
||||||
|
|
||||||
# Setup NAT masquerading on external interfaces
|
|
||||||
chain postrouting {
|
|
||||||
type nat hook postrouting priority filter; policy accept;
|
|
||||||
oifname { "wan", "wg_cloonar", "wrwks", "wg_epicenter", "wg_ghetto_at" } masquerade
|
|
||||||
ip daddr 10.42.97.50 masquerade
|
|
||||||
}
|
|
||||||
}
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
systemd.services.nftables-fix = {
|
|
||||||
description = "Delete nixos-fw table";
|
|
||||||
after = [ "nftables.service" ];
|
|
||||||
|
|
||||||
serviceConfig = let
|
|
||||||
fixScript = pkgs.writeTextFile {
|
|
||||||
name = "nftables-fix";
|
|
||||||
executable = true;
|
|
||||||
text = ''
|
|
||||||
#! ${pkgs.nftables}/bin/nft -f
|
|
||||||
delete table inet nixos-fw
|
|
||||||
'';
|
|
||||||
};
|
};
|
||||||
in {
|
|
||||||
Name = "nftables-fix";
|
|
||||||
PartOf = "nftables.service";
|
|
||||||
Type = "oneshot";
|
|
||||||
ExecStart= [ fixScript ];
|
|
||||||
StateDirectory = "nftables";
|
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
|
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -73,7 +73,7 @@ let
|
|||||||
"\"upgrade-staging.wienbautvor.at IN A 10.254.240.110\""
|
"\"upgrade-staging.wienbautvor.at IN A 10.254.240.110\""
|
||||||
"\"upgrade-staging.wienwohntbesser.at IN A 10.254.240.110\""
|
"\"upgrade-staging.wienwohntbesser.at IN A 10.254.240.110\""
|
||||||
|
|
||||||
"\"metz.cloonar.com IN A 10.42.96.167\""
|
"\"metz.cloonar.com IN A 10.42.99.10\""
|
||||||
"\"firetv-living.cloonar.com IN A 10.42.96.175\""
|
"\"firetv-living.cloonar.com IN A 10.42.96.175\""
|
||||||
"\"ps5-living.cloonar.com IN A 10.42.96.176\""
|
"\"ps5-living.cloonar.com IN A 10.42.96.176\""
|
||||||
|
|
||||||
@@ -220,4 +220,6 @@ in {
|
|||||||
partOf = [ "unbound.service" ];
|
partOf = [ "unbound.service" ];
|
||||||
wantedBy = [ "multi-user.target" ];
|
wantedBy = [ "multi-user.target" ];
|
||||||
};
|
};
|
||||||
|
|
||||||
|
networking.firewall.allowedUDPPorts = [ 53 5353 ];
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -48,4 +48,6 @@
|
|||||||
];
|
];
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
|
networking.firewall.allowedUDPPorts = [ 51820 ];
|
||||||
}
|
}
|
||||||
|
|||||||
Reference in New Issue
Block a user