Skynet/nixos
6
1
Fork 0
Code Issues 43 Pull requests 1 Projects Releases Packages Wiki Activity Actions

feat: can let each machiene add teh forwards it needs

Browse source
This commit is contained in:
silver 2023-01-15 13:32:18 +00:00
parent a07bc6774c
commit c819214902
1 changed files with 73 additions and 55 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

128
applications/firewall.nix
View file

@ -1,73 +1,91 @@
{ {lib, config, ...}:{
networking.firewall.enable = false; # using https://github.com/greaka/ops/blob/818be4c4dea9129abe0f086d738df4cb0bb38288/apps/restic/options.nix as a base
networking.nftables.enable = true; options = {
firewall_forward = lib.mkOption {
default = [ ];
type = lib.types.listOf lib.types.str;
description = ''
A list of routes to forward
'';
};
};
# fules for the firewall config = {
# beware of EOL conversion. # disable default firewall to enable nftables
networking.nftables.ruleset = networking.firewall.enable = false;
'' networking.nftables.enable = true;
# Check out https://wiki.nftables.org/ for better documentation.
# Table for both IPv4 and IPv6.
table ip nat {
chain prerouting {
type nat hook prerouting priority dstnat; policy accept;
# forward anything with port 2222 to this specific ip # fules for the firewall
# tcp dport 2222 counter packets 0 bytes 0 dnat to 193.1.99.76:22 # beware of EOL conversion.
networking.nftables.ruleset =
''
# Check out https://wiki.nftables.org/ for better documentation.
# Table for both IPv4 and IPv6.
table ip nat {
chain prerouting {
type nat hook prerouting priority dstnat; policy accept;
# forward http/s traffic from 76 to 123 # forward anything with port 2222 to this specific ip
# ip daddr 193.1.99.76 tcp dport 80 counter packets 0 bytes 0 dnat to 193.1.99.123:80 # tcp dport 2222 counter packets 0 bytes 0 dnat to 193.1.99.76:22
# ip daddr 193.1.99.76 tcp dport 443 counter packets 0 bytes 0 dnat to 193.1.99.123:443
}
chain postrouting { # forward http/s traffic from 76 to 123
type nat hook postrouting priority srcnat; policy accept; # ip daddr 193.1.99.76 tcp dport 80 counter packets 0 bytes 0 dnat to 193.1.99.123:80
# ip daddr 193.1.99.76 tcp dport 443 counter packets 0 bytes 0 dnat to 193.1.99.123:443
}
# the internal network chain postrouting {
ip saddr 172.20.20.0/23 counter packets 0 bytes 0 masquerade type nat hook postrouting priority srcnat; policy accept;
}
chain output { # the internal network
type nat hook output priority -100; policy accept; ip saddr 172.20.20.0/23 counter packets 0 bytes 0 masquerade
} }
}
table ip filter { chain output {
chain input { type nat hook output priority -100; policy accept;
type filter hook input priority filter; policy accept; }
tcp dport 22 counter packets 0 bytes 0 jump fail2ban-ssh }
tcp dport 22 counter packets 0 bytes 0 accept
}
chain forward { table ip filter {
type filter hook forward priority filter; policy drop; chain input {
counter packets 0 bytes 0 jump rejects type filter hook input priority filter; policy accept;
tcp dport 22 counter packets 0 bytes 0 jump fail2ban-ssh
tcp dport 22 counter packets 0 bytes 0 accept
}
# accept these ip/ports chain forward {
# ip saddr 193.1.99.123 tcp dport 443 counter packets 0 bytes 0 accept type filter hook forward priority filter; policy drop;
counter packets 0 bytes 0 jump rejects
counter packets 0 bytes 0 reject with icmp type admin-prohibited # accept these ip/ports
} # ip saddr 193.1.99.123 tcp dport 443 counter packets 0 bytes 0 accept
chain output { # can basically make each machiene responsibile for their own forwarding (in config at least)
type filter hook output priority filter; policy accept; ${lib.strings.concatMapStrings (x: x + "\n") config.firewall_forward}
# no outgoing limits (for now) counter packets 0 bytes 0 reject with icmp type admin-prohibited
} }
chain fail2ban-ssh { chain output {
# ban these type filter hook output priority filter; policy accept;
# ip saddr 104.236.151.120 counter packets 0 bytes 0 drop
counter packets 0 bytes 0 return
}
chain rejects { # no outgoing limits (for now)
# Reject all these }
# ip saddr 220.119.33.251 counter packets 0 bytes 0 reject with icmp type admin-prohibited
} chain fail2ban-ssh {
} # ban these
''; # ip saddr 104.236.151.120 counter packets 0 bytes 0 drop
counter packets 0 bytes 0 return
}
chain rejects {
# Reject all these
# ip saddr 220.119.33.251 counter packets 0 bytes 0 reject with icmp type admin-prohibited
}
}
'';
};
} }