Skynet/nixos
6
1
Fork 0
Code Issues 42 Pull requests 1 Projects Releases Packages Wiki Activity Actions

feat: added better options to teh firewall

Browse source
This commit is contained in:
silver 2023-01-17 15:46:07 +00:00
parent 7428a53325
commit c2e4fde98d
2 changed files with 45 additions and 24 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

27
applications/firewall.nix
View file

@ -17,7 +17,8 @@
'';
};
own_ip = lib.mkOption {
own = {
ip = lib.mkOption {
default = "127.0.0.1";
type = lib.types.str;
description = ''
@ -25,13 +26,26 @@
'';
};
own_ports = lib.mkOption {
ports = {
tcp = lib.mkOption {
default = [ ];
type = lib.types.listOf lib.types.int;
description = ''
A list of ports for the machiene running the firewall
A list of TCP ports for the machiene running the firewall
'';
};
udp = lib.mkOption {
default = [ ];
type = lib.types.listOf lib.types.int;
description = ''
A list of UDP ports for the machiene running the firewall
'';
};
};
};
};
};
@ -73,8 +87,13 @@
table ip filter {
chain input {
type filter hook input priority filter; policy accept;
# for the host machiene
${lib.strings.concatMapStrings (x: x + "\n") (map (port: "tcp dport ${toString port} counter packets 0 bytes 0 accept") config.skynet_firewall.own_ports)}
# TCP
${lib.strings.concatMapStrings (x: x + "\n") (map (port: "tcp dport ${toString port} counter packets 0 bytes 0 accept") config.skynet_firewall.own.ports.tcp)}
# UDP
${lib.strings.concatMapStrings (x: x + "\n") (map (port: "udp dport ${toString port} counter packets 0 bytes 0 accept") config.skynet_firewall.own.ports.udp)}
}
chain forward {

18
machines/agentjones.nix
View file

@ -16,17 +16,19 @@
# this server is teh firewall
skynet_firewall = {
# always good to know oneself
#own_ip = "193.1.99.72";
own_ip = "192.168.1.157";
own_ports = [
# ssh
own = {
#ip = "193.1.99.72";
ip = "192.168.1.157";
ports = {
tcp = [
# ssh in
22
# dns
53
# wireguard
51820
];
udp = [];
};
};
enable = true;