fix: eol conversion round 2
This commit is contained in:
parent
180feb17ec
commit
3d7f99946a
17 changed files with 1324 additions and 1324 deletions
|
|
@ -1,134 +1,134 @@
|
|||
{lib, pkgs, config, ...}: {
|
||||
|
||||
# using https://github.com/greaka/ops/blob/818be4c4dea9129abe0f086d738df4cb0bb38288/apps/restic/options.nix as a base
|
||||
options = {
|
||||
skynet_firewall = {
|
||||
enable = lib.mkEnableOption {
|
||||
default = false;
|
||||
example = true;
|
||||
description = "Skynet Firewall";
|
||||
type = lib.types.bool;
|
||||
};
|
||||
forward = lib.mkOption {
|
||||
default = [ ];
|
||||
type = lib.types.listOf lib.types.str;
|
||||
description = ''
|
||||
A list of routes to forward
|
||||
'';
|
||||
};
|
||||
|
||||
own = {
|
||||
ip = lib.mkOption {
|
||||
default = "127.0.0.1";
|
||||
type = lib.types.str;
|
||||
description = ''
|
||||
IP of the firewall
|
||||
'';
|
||||
};
|
||||
|
||||
ports = {
|
||||
tcp = lib.mkOption {
|
||||
default = [ ];
|
||||
type = lib.types.listOf lib.types.int;
|
||||
description = ''
|
||||
A list of TCP ports for the machiene running the firewall
|
||||
'';
|
||||
};
|
||||
|
||||
udp = lib.mkOption {
|
||||
default = [ ];
|
||||
type = lib.types.listOf lib.types.int;
|
||||
description = ''
|
||||
A list of UDP ports for the machiene running the firewall
|
||||
'';
|
||||
};
|
||||
|
||||
};
|
||||
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf config.skynet_firewall.enable {
|
||||
# disable default firewall to enable nftables
|
||||
networking.firewall.enable = false;
|
||||
networking.nftables.enable = true;
|
||||
|
||||
# fules for the firewall
|
||||
# beware of EOL conversion.
|
||||
networking.nftables.ruleset =
|
||||
''
|
||||
# Check out https://wiki.nftables.org/ for better documentation.
|
||||
# Table for both IPv4 and IPv6.
|
||||
table ip nat {
|
||||
chain prerouting {
|
||||
type nat hook prerouting priority dstnat; policy accept;
|
||||
|
||||
# forward anything with port 2222 to this specific ip
|
||||
# tcp dport 2222 counter packets 0 bytes 0 dnat to 193.1.99.76:22
|
||||
|
||||
# forward http/s traffic from 76 to 123
|
||||
# ip daddr 193.1.99.76 tcp dport 80 counter packets 0 bytes 0 dnat to 193.1.99.123:80
|
||||
# ip daddr 193.1.99.76 tcp dport 443 counter packets 0 bytes 0 dnat to 193.1.99.123:443
|
||||
}
|
||||
|
||||
chain postrouting {
|
||||
type nat hook postrouting priority srcnat; policy accept;
|
||||
|
||||
# the internal network
|
||||
ip saddr 172.20.20.0/23 counter packets 0 bytes 0 masquerade
|
||||
}
|
||||
|
||||
chain output {
|
||||
type nat hook output priority -100; policy accept;
|
||||
}
|
||||
}
|
||||
|
||||
table ip filter {
|
||||
chain input {
|
||||
type filter hook input priority filter; policy accept;
|
||||
|
||||
# for the host machiene
|
||||
# TCP
|
||||
${lib.strings.concatMapStrings (x: x + "\n") (map (port: "tcp dport ${toString port} counter packets 0 bytes 0 accept") config.skynet_firewall.own.ports.tcp)}
|
||||
|
||||
# UDP
|
||||
${lib.strings.concatMapStrings (x: x + "\n") (map (port: "udp dport ${toString port} counter packets 0 bytes 0 accept") config.skynet_firewall.own.ports.udp)}
|
||||
}
|
||||
|
||||
chain forward {
|
||||
type filter hook forward priority filter; policy drop;
|
||||
counter packets 0 bytes 0 jump rejects
|
||||
|
||||
# accept these ip/ports
|
||||
# ip saddr 193.1.99.123 tcp dport 443 counter packets 0 bytes 0 accept
|
||||
|
||||
# can basically make each machiene responsibile for their own forwarding (in config at least)
|
||||
${lib.strings.concatMapStrings (x: x + "\n") config.skynet_firewall.forward}
|
||||
|
||||
counter packets 0 bytes 0 reject with icmp type admin-prohibited
|
||||
}
|
||||
|
||||
chain output {
|
||||
type filter hook output priority filter; policy accept;
|
||||
|
||||
# no outgoing limits (for now)
|
||||
}
|
||||
|
||||
chain fail2ban-ssh {
|
||||
# ban these
|
||||
# ip saddr 104.236.151.120 counter packets 0 bytes 0 drop
|
||||
counter packets 0 bytes 0 return
|
||||
}
|
||||
|
||||
chain rejects {
|
||||
# Reject all these
|
||||
# ip saddr 220.119.33.251 counter packets 0 bytes 0 reject with icmp type admin-prohibited
|
||||
}
|
||||
}
|
||||
'';
|
||||
|
||||
};
|
||||
|
||||
|
||||
}
|
||||
{lib, pkgs, config, ...}: {
|
||||
|
||||
# using https://github.com/greaka/ops/blob/818be4c4dea9129abe0f086d738df4cb0bb38288/apps/restic/options.nix as a base
|
||||
options = {
|
||||
skynet_firewall = {
|
||||
enable = lib.mkEnableOption {
|
||||
default = false;
|
||||
example = true;
|
||||
description = "Skynet Firewall";
|
||||
type = lib.types.bool;
|
||||
};
|
||||
forward = lib.mkOption {
|
||||
default = [ ];
|
||||
type = lib.types.listOf lib.types.str;
|
||||
description = ''
|
||||
A list of routes to forward
|
||||
'';
|
||||
};
|
||||
|
||||
own = {
|
||||
ip = lib.mkOption {
|
||||
default = "127.0.0.1";
|
||||
type = lib.types.str;
|
||||
description = ''
|
||||
IP of the firewall
|
||||
'';
|
||||
};
|
||||
|
||||
ports = {
|
||||
tcp = lib.mkOption {
|
||||
default = [ ];
|
||||
type = lib.types.listOf lib.types.int;
|
||||
description = ''
|
||||
A list of TCP ports for the machiene running the firewall
|
||||
'';
|
||||
};
|
||||
|
||||
udp = lib.mkOption {
|
||||
default = [ ];
|
||||
type = lib.types.listOf lib.types.int;
|
||||
description = ''
|
||||
A list of UDP ports for the machiene running the firewall
|
||||
'';
|
||||
};
|
||||
|
||||
};
|
||||
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf config.skynet_firewall.enable {
|
||||
# disable default firewall to enable nftables
|
||||
networking.firewall.enable = false;
|
||||
networking.nftables.enable = true;
|
||||
|
||||
# fules for the firewall
|
||||
# beware of EOL conversion.
|
||||
networking.nftables.ruleset =
|
||||
''
|
||||
# Check out https://wiki.nftables.org/ for better documentation.
|
||||
# Table for both IPv4 and IPv6.
|
||||
table ip nat {
|
||||
chain prerouting {
|
||||
type nat hook prerouting priority dstnat; policy accept;
|
||||
|
||||
# forward anything with port 2222 to this specific ip
|
||||
# tcp dport 2222 counter packets 0 bytes 0 dnat to 193.1.99.76:22
|
||||
|
||||
# forward http/s traffic from 76 to 123
|
||||
# ip daddr 193.1.99.76 tcp dport 80 counter packets 0 bytes 0 dnat to 193.1.99.123:80
|
||||
# ip daddr 193.1.99.76 tcp dport 443 counter packets 0 bytes 0 dnat to 193.1.99.123:443
|
||||
}
|
||||
|
||||
chain postrouting {
|
||||
type nat hook postrouting priority srcnat; policy accept;
|
||||
|
||||
# the internal network
|
||||
ip saddr 172.20.20.0/23 counter packets 0 bytes 0 masquerade
|
||||
}
|
||||
|
||||
chain output {
|
||||
type nat hook output priority -100; policy accept;
|
||||
}
|
||||
}
|
||||
|
||||
table ip filter {
|
||||
chain input {
|
||||
type filter hook input priority filter; policy accept;
|
||||
|
||||
# for the host machiene
|
||||
# TCP
|
||||
${lib.strings.concatMapStrings (x: x + "\n") (map (port: "tcp dport ${toString port} counter packets 0 bytes 0 accept") config.skynet_firewall.own.ports.tcp)}
|
||||
|
||||
# UDP
|
||||
${lib.strings.concatMapStrings (x: x + "\n") (map (port: "udp dport ${toString port} counter packets 0 bytes 0 accept") config.skynet_firewall.own.ports.udp)}
|
||||
}
|
||||
|
||||
chain forward {
|
||||
type filter hook forward priority filter; policy drop;
|
||||
counter packets 0 bytes 0 jump rejects
|
||||
|
||||
# accept these ip/ports
|
||||
# ip saddr 193.1.99.123 tcp dport 443 counter packets 0 bytes 0 accept
|
||||
|
||||
# can basically make each machiene responsibile for their own forwarding (in config at least)
|
||||
${lib.strings.concatMapStrings (x: x + "\n") config.skynet_firewall.forward}
|
||||
|
||||
counter packets 0 bytes 0 reject with icmp type admin-prohibited
|
||||
}
|
||||
|
||||
chain output {
|
||||
type filter hook output priority filter; policy accept;
|
||||
|
||||
# no outgoing limits (for now)
|
||||
}
|
||||
|
||||
chain fail2ban-ssh {
|
||||
# ban these
|
||||
# ip saddr 104.236.151.120 counter packets 0 bytes 0 drop
|
||||
counter packets 0 bytes 0 return
|
||||
}
|
||||
|
||||
chain rejects {
|
||||
# Reject all these
|
||||
# ip saddr 220.119.33.251 counter packets 0 bytes 0 reject with icmp type admin-prohibited
|
||||
}
|
||||
}
|
||||
'';
|
||||
|
||||
};
|
||||
|
||||
|
||||
}
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue