Skynet/nixos
6
1
Fork 0
Code Issues 43 Pull requests 1 Projects Releases Packages Wiki Activity Actions

feat: added better options to teh firewall

Browse source
This commit is contained in:
silver 2023-01-17 15:46:07 +00:00
parent 7428a53325
commit c2e4fde98d
2 changed files with 45 additions and 24 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

27
applications/firewall.nix
View file

@ -17,7 +17,8 @@
''; '';
}; };
own_ip = lib.mkOption { own = {
ip = lib.mkOption {
default = "127.0.0.1"; default = "127.0.0.1";
type = lib.types.str; type = lib.types.str;
description = '' description = ''
@ -25,13 +26,26 @@
''; '';
}; };
own_ports = lib.mkOption { ports = {
tcp = lib.mkOption {
default = [ ]; default = [ ];
type = lib.types.listOf lib.types.int; type = lib.types.listOf lib.types.int;
description = '' description = ''
A list of ports for the machiene running the firewall A list of TCP ports for the machiene running the firewall
''; '';
}; };
udp = lib.mkOption {
default = [ ];
type = lib.types.listOf lib.types.int;
description = ''
A list of UDP ports for the machiene running the firewall
'';
};
};
};
}; };
}; };
@ -73,8 +87,13 @@
table ip filter { table ip filter {
chain input { chain input {
type filter hook input priority filter; policy accept; type filter hook input priority filter; policy accept;
# for the host machiene # for the host machiene
${lib.strings.concatMapStrings (x: x + "\n") (map (port: "tcp dport ${toString port} counter packets 0 bytes 0 accept") config.skynet_firewall.own_ports)} # TCP
${lib.strings.concatMapStrings (x: x + "\n") (map (port: "tcp dport ${toString port} counter packets 0 bytes 0 accept") config.skynet_firewall.own.ports.tcp)}
# UDP
${lib.strings.concatMapStrings (x: x + "\n") (map (port: "udp dport ${toString port} counter packets 0 bytes 0 accept") config.skynet_firewall.own.ports.udp)}
} }
chain forward { chain forward {

18
machines/agentjones.nix
View file

@ -16,17 +16,19 @@
# this server is teh firewall # this server is teh firewall
skynet_firewall = { skynet_firewall = {
# always good to know oneself # always good to know oneself
#own_ip = "193.1.99.72";
own_ip = "192.168.1.157";
own_ports = [ own = {
# ssh #ip = "193.1.99.72";
ip = "192.168.1.157";
ports = {
tcp = [
# ssh in
22 22
# dns
53
# wireguard
51820
]; ];
udp = [];
};
};
enable = true; enable = true;