Skynet/nixos
6
1
Fork 0
Code Issues 43 Pull requests 1 Projects Releases Packages Wiki Activity Actions

feat: added better options to teh firewall

Browse source
This commit is contained in:
silver 2023-01-17 15:46:07 +00:00
parent 7428a53325
commit c2e4fde98d
2 changed files with 45 additions and 24 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

47
applications/firewall.nix
View file

@ -17,20 +17,34 @@
''; '';
}; };
own_ip = lib.mkOption { own = {
default = "127.0.0.1"; ip = lib.mkOption {
type = lib.types.str; default = "127.0.0.1";
description = '' type = lib.types.str;
IP of the firewall description = ''
''; IP of the firewall
}; '';
};
ports = {
tcp = lib.mkOption {
default = [ ];
type = lib.types.listOf lib.types.int;
description = ''
A list of TCP ports for the machiene running the firewall
'';
};
udp = lib.mkOption {
default = [ ];
type = lib.types.listOf lib.types.int;
description = ''
A list of UDP ports for the machiene running the firewall
'';
};
};
own_ports = lib.mkOption {
default = [ ];
type = lib.types.listOf lib.types.int;
description = ''
A list of ports for the machiene running the firewall
'';
}; };
}; };
}; };
@ -73,8 +87,13 @@
table ip filter { table ip filter {
chain input { chain input {
type filter hook input priority filter; policy accept; type filter hook input priority filter; policy accept;
# for the host machiene # for the host machiene
${lib.strings.concatMapStrings (x: x + "\n") (map (port: "tcp dport ${toString port} counter packets 0 bytes 0 accept") config.skynet_firewall.own_ports)} # TCP
${lib.strings.concatMapStrings (x: x + "\n") (map (port: "tcp dport ${toString port} counter packets 0 bytes 0 accept") config.skynet_firewall.own.ports.tcp)}
# UDP
${lib.strings.concatMapStrings (x: x + "\n") (map (port: "udp dport ${toString port} counter packets 0 bytes 0 accept") config.skynet_firewall.own.ports.udp)}
} }
chain forward { chain forward {

22
machines/agentjones.nix
View file

@ -16,17 +16,19 @@
# this server is teh firewall # this server is teh firewall
skynet_firewall = { skynet_firewall = {
# always good to know oneself # always good to know oneself
#own_ip = "193.1.99.72";
own_ip = "192.168.1.157";
own_ports = [ own = {
# ssh #ip = "193.1.99.72";
22 ip = "192.168.1.157";
# dns
53 ports = {
# wireguard tcp = [
51820 # ssh in
]; 22
];
udp = [];
};
};
enable = true; enable = true;