greg/nixos
1
0
Fork 2
Code Issues Pull Requests 2 Actions Packages Projects Releases Wiki Activity

Rework router to support incoming ports

Browse Source
This commit is contained in:
Greg Hellings
2023-05-05 19:21:11 -05:00
parent 394f503326
commit 65259176f4
1 changed files with 39 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules-linux/router.nix
+39 -34
View File
@@ -3,46 +3,51 @@
let let
names = mylist: (lib.strings.concatMapStringsSep "," (x: ''"${x}"'') mylist); names = mylist: (lib.strings.concatMapStringsSep "," (x: ''"${x}"'') mylist);
# Pass the names of the wan/lan ports # Pass the names of the wan/lan ports
nftConfig = { wan, lan, limitedLan ? [] }: nftConfig = {
let wan,
lan,
limitedLan ? [],
openPorts ? [ "ssh" "67" "53" ] # ssh, dhcpd, dns
}: let
lanList = names lan; lanList = names lan;
allLan = names (lan ++ limitedLan); allLan = names (lan ++ limitedLan);
wanName = names wan; wanName = names wan;
in portsString = lib.strings.concatMapStringsSep "\n" (x: "iifname { ${lanList}, \"tailscale0\" } tcp dport ${x} accept") openPorts;
'' in lib.strings.concatStringsSep "\n" [
table ip filter { "table ip filter {"
chain input { " chain input {"
type filter hook input priority 0; policy drop; " type filter hook input priority 0; policy drop;"
iifname lo accept " iifname lo accept"
iifname { ${lanList} } accept comment "Allows LAN traffic and outgoing" portsString
iifname { ${wanName} } ct state { established, related } accept comment "Allows existing connections" " iifname { ${lanList} } accept comment \"Allows LAN traffic and outgoing\""
iifname { ${wanName} } icmp type { echo-request, destination-unreachable, time-exceeded } counter accept comment "Allow some ICMP traffic" " iifname { ${wanName} } ct state { established, related } accept comment \"Allows existing connections\""
iifname { ${wanName} } counter drop comment "Drop other incoming traffic, and count how much" " iifname { ${wanName} } icmp type { echo-request, destination-unreachable, time-exceeded } counter accept comment \"Allow some ICMP traffic\""
} " iifname { ${wanName} } counter drop comment \"Drop other incoming traffic, and count how much\""
chain forward { " }"
type filter hook forward priority 0; policy drop; " chain forward {"
iifname { ${allLan} } oifname { ${wanName} } accept comment "Forward LAN to WAN" " type filter hook forward priority 0; policy drop;"
iifname { ${wanName} } oifname { ${allLan} } ct state established, related accept comment "Allow incoming established traffic" " iifname { ${allLan} } oifname { ${wanName} } accept comment \"Forward LAN to WAN\""
} " iifname { ${wanName} } oifname { ${allLan} } ct state established, related accept comment \"Allow incoming established traffic\""
} " }"
"}"
table ip nat { "table ip nat {"
chain postrouting { " chain postrouting {"
type nat hook postrouting priority 100; policy accept; " type nat hook postrouting priority 100; policy accept;"
oifname { ${wanName} } masquerade " oifname { ${wanName} } masquerade"
} " }"
} "}"
table ip6 filter { "table ip6 filter {"
chain input { " chain input {"
type filter hook input priority 0; policy drop; " type filter hook input priority 0; policy drop;"
} " }"
chain forward { " chain forward {"
type filter hook forward priority 0; policy drop; " type filter hook forward priority 0; policy drop;"
} " }"
} "}"
''; ];
cfg = config.greg.router; cfg = config.greg.router;
in with lib; { in with lib; {