77 lines
2.1 KiB
Nix
77 lines
2.1 KiB
Nix
{ config, lib, pkgs, ... }:
|
|
|
|
let
|
|
names = mylist: (lib.strings.concatMapStringsSep "," (x: ''"${x}"'') mylist);
|
|
# Pass the names of the wan/lan ports
|
|
nftConfig = { wan, lan, limitedLan ? [] }:
|
|
let
|
|
lanList = names lan;
|
|
allLan = names (lan ++ limitedLan);
|
|
wanName = ''"${wan}"'';
|
|
in
|
|
''
|
|
table ip filter {
|
|
chain input {
|
|
type filter hook input priority 0; policy drop;
|
|
|
|
iifname { ${lanList} } accept comment "Allows LAN traffic and outgoing"
|
|
iifname ${wanName} ct state { established, related } accept comment "Allows existing connections"
|
|
iifname ${wanName} icmp type { echo-request, destination-unreachable, time-exceeded } counter accept comment "Allow some ICMP traffic"
|
|
iifname ${wanName} counter drop comment "Drop other incoming traffic, and count how much"
|
|
}
|
|
chain forward {
|
|
type filter hook forward priority 0; policy drop;
|
|
iifname { ${allLan} } oifname { ${wanName} } accept comment "Forward LAN to WAN"
|
|
iifname { ${wanName} } oifname { ${allLan} } ct state established, related accept comment "Allow incoming established traffic"
|
|
}
|
|
}
|
|
|
|
table ip nat {
|
|
chain postrouting {
|
|
type nat hook postrouting priority 100; policy accept;
|
|
oifname "${wan}" masquerade
|
|
}
|
|
}
|
|
|
|
table ip6 filter {
|
|
chain input {
|
|
type filter hook input priority 0; policy drop;
|
|
}
|
|
chain forward {
|
|
type filter hook forward priority 0; policy drop;
|
|
}
|
|
}
|
|
'';
|
|
cfg = config.greg.router;
|
|
|
|
in with lib; {
|
|
options.greg.router = {
|
|
enable = mkEnableOption "Enable NFTables and routing";
|
|
wan = mkOption {
|
|
type = types.str;
|
|
description = "The name of the network interface that is the WAN connection";
|
|
};
|
|
lan = mkOption {
|
|
type = (types.listOf types.str);
|
|
description = "A list of all network interfaces that are considered LAN connections";
|
|
};
|
|
limited = mkOption {
|
|
type = (types.listOf types.str);
|
|
description = "A list of limited access LAN connections - such as IOT connections and similar.";
|
|
default = [];
|
|
};
|
|
};
|
|
|
|
config = mkIf cfg.enable {
|
|
networking.nftables = {
|
|
enable = true;
|
|
ruleset = (nftConfig { lan = cfg.lan; wan = cfg.wan; });
|
|
};
|
|
|
|
environment.systemPackages = [
|
|
pkgs.pciutils
|
|
pkgs.tcpdump
|
|
];
|
|
};
|
|
}
|