Greg Hellings
88c28ed0f2
Removed lots of overlays that are redundant now Added copier to home tools Added static DHCP leases to dnsmasq Improved router Added ability to read Jinja2 template files
94 lines
2.9 KiB
Nix
94 lines
2.9 KiB
Nix
{ config, lib, pkgs, ... }:
|
|
|
|
let
|
|
names = mylist: (lib.strings.concatMapStringsSep "," (x: ''"${x}"'') mylist);
|
|
# Pass the names of the wan/lan ports
|
|
nftConfig = {
|
|
wan,
|
|
lan,
|
|
limitedLan ? [],
|
|
openPorts ? [ "ssh" "67" "53" ], # ssh, dhcpd, dns
|
|
openUDPPorts ? [ "67" "53" ] # dhcpd, dns
|
|
}: let
|
|
lanList = names lan;
|
|
allLan = names (lan ++ limitedLan);
|
|
wanName = names wan;
|
|
portsString = lib.strings.concatMapStringsSep "\n" (x: "iifname { ${lanList}, \"tailscale0\" } tcp dport ${toString x} accept") openPorts;
|
|
udpPortsString = lib.strings.concatMapStringsSep "\n" (x: "iifname { ${lanList}, \"tailscale0\" } udp dport ${toString x} accept") openUDPPorts;
|
|
in lib.strings.concatStringsSep "\n" [
|
|
"table ip filter {"
|
|
" chain output {"
|
|
" type filter hook output priority 100; policy accept;"
|
|
" }"
|
|
|
|
" chain input {"
|
|
" type filter hook input priority 0; policy drop;"
|
|
|
|
" iifname lo accept"
|
|
portsString
|
|
udpPortsString
|
|
" iifname { ${lanList} } accept comment \"Allows LAN traffic and outgoing\""
|
|
" iifname { ${wanName} } ct state { established, related } accept comment \"Allows existing connections\""
|
|
" iifname { ${wanName} } icmp type { echo-request, destination-unreachable, time-exceeded } counter accept comment \"Allow some ICMP traffic\""
|
|
" iifname { ${wanName} } counter drop comment \"Drop other incoming traffic, and count how much\""
|
|
" }"
|
|
" chain forward {"
|
|
" type filter hook forward priority 0; policy drop;"
|
|
" iifname { ${allLan} } oifname { ${wanName} } accept comment \"Forward LAN to WAN\""
|
|
" iifname { ${wanName} } oifname { ${allLan} } ct state established, related accept comment \"Allow incoming established traffic\""
|
|
" }"
|
|
"}"
|
|
|
|
"table ip nat {"
|
|
" chain postrouting {"
|
|
" type nat hook postrouting priority 100; policy accept;"
|
|
" oifname { ${wanName} } masquerade"
|
|
" }"
|
|
"}"
|
|
|
|
"table ip6 filter {"
|
|
" chain input {"
|
|
" type filter hook input priority 0; policy drop;"
|
|
" }"
|
|
" chain forward {"
|
|
" type filter hook forward priority 0; policy drop;"
|
|
" }"
|
|
"}"
|
|
];
|
|
cfg = config.greg.router;
|
|
|
|
in with lib; {
|
|
options.greg.router = {
|
|
enable = mkEnableOption "Enable NFTables and routing";
|
|
wan = mkOption {
|
|
type = (types.listOf types.str);
|
|
description = "The name of the network interface that is the WAN connection";
|
|
};
|
|
lan = mkOption {
|
|
type = (types.listOf types.str);
|
|
description = "A list of all network interfaces that are considered LAN connections";
|
|
};
|
|
limited = mkOption {
|
|
type = (types.listOf types.str);
|
|
description = "A list of limited access LAN connections - such as IOT connections and similar.";
|
|
default = [];
|
|
};
|
|
};
|
|
|
|
config = mkIf cfg.enable {
|
|
networking.nftables = {
|
|
enable = true;
|
|
ruleset = (nftConfig {
|
|
inherit (cfg) lan wan;
|
|
openPorts = config.networking.firewall.allowedTCPPorts;
|
|
openUDPPorts = config.networking.firewall.allowedUDPPorts;
|
|
});
|
|
};
|
|
|
|
environment.systemPackages = [
|
|
pkgs.pciutils
|
|
pkgs.tcpdump
|
|
];
|
|
};
|
|
}
|