imxyy1soope1/nixos-dotfiles
1
0
Fork 0
Code Issues Pull Requests Actions Activity

net: switch from manual nftables to firewall module

Browse Source
This commit is contained in:
imxyy1soope1
2026-07-27 21:57:06 +08:00
parent 612ad77325
commit fef9f79a78
5 changed files with 44 additions and 144 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hosts/imxyy-nix-server/net.nix
+19 -68
View File
@@ -47,81 +47,31 @@
"192.168.3.2"
];
firewall.enable = false;
nftables = {
firewall = {
enable = true;
flushRuleset = true;
ruleset = ''
table inet firewall {
set LANv4 {
type ipv4_addr
flags interval
elements = { 10.0.0.0/8, 100.64.0.0/10, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16 }
}
set LANv6 {
type ipv6_addr
flags interval
elements = { fd00::/8, fe80::/10 }
}
set tcp_ports {
type inet_service
flags interval
elements = {
http,
https,
2222,
25565
}
}
chain prerouting {
type filter hook prerouting priority mangle; policy accept;
ip daddr @LANv4 accept
ip6 daddr @LANv6 accept
}
chain output {
type filter hook output priority 100; policy accept;
ip daddr @LANv4 accept
ip6 daddr @LANv6 accept
}
chain input {
type filter hook input priority 0; policy drop;
iif lo accept
ct state invalid drop
ct state established,related accept
ip protocol { icmp, igmp } accept
ip saddr @LANv4 accept
ip6 saddr @LANv6 accept
tcp dport 2222 ct state new limit rate 15/minute counter accept
tcp dport @tcp_ports counter accept
}
chain forward {
type filter hook forward priority 0; policy accept;
}
chain nat {
type nat hook postrouting priority 0; policy accept;
ip saddr 192.168.3.0/24 masquerade
}
}
checkReversePath = false;
allowedTCPPorts = [
80
443
2222
];
extraInputRules = ''
ip saddr { 10.0.0.0/8, 100.64.0.0/10, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16 } accept
ip6 saddr { fd00::/8, fe80::/10 } accept
'';
filterForward = false;
};
nftables.enable = true;
nat = {
enable = true;
externalInterface = "mac0";
internalIPs = [ "192.168.3.0/24" ];
};
};
services.openssh = {
enable = true;
openFirewall = false;
settings = {
# PermitRootLogin = "yes";
PermitRootLogin = "prohibit-password";
@@ -143,6 +93,7 @@
services.dae = {
enable = true;
configFile = config.sops.secrets.dae-imxyy-nix-server.path;
openFirewall.enable = false;
};
systemd.services.dae = {
after = [ "sops-nix.service" ];
hosts/imxyy-nix-x16/net.nix
+9 -36
View File
@@ -12,45 +12,17 @@
my.persist.nixosDirs = [ "/etc/NetworkManager/system-connections" ];
networking = {
networkmanager.enable = true;
firewall.enable = false;
nftables = {
firewall = {
enable = true;
flushRuleset = true;
ruleset = ''
table inet firewall {
set LANv4 {
type ipv4_addr
flags interval
elements = { 10.0.0.0/8, 100.64.0.0/10, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16 }
}
set LANv6 {
type ipv6_addr
flags interval
elements = { fd00::/8, fe80::/10 }
}
chain output {
type filter hook output priority 100; policy accept;
}
chain input {
type filter hook input priority 0; policy drop;
iif lo accept
ct state invalid drop
ct state established,related accept
ip saddr @LANv4 accept
ip6 saddr @LANv6 accept
}
chain forward {
type filter hook forward priority 0; policy drop;
}
}
checkReversePath = false;
allowPing = false;
extraInputRules = ''
ip saddr { 10.0.0.0/8, 100.64.0.0/10, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16 } accept
ip6 saddr { fd00::/8, fe80::/10 } accept
'';
filterForward = true;
};
nftables.enable = true;
};
sops.secrets.dae-imxyy-nix-x16 = {
@@ -61,6 +33,7 @@
services.dae = {
enable = true;
configFile = config.sops.secrets.dae-imxyy-nix-x16.path;
openFirewall.enable = false;
};
systemd.services.dae.after = [ "sops-nix.service" ];
sops.secrets.mihomo = {
hosts/imxyy-nix-x16/nixos.nix
+1
View File
@@ -31,6 +31,7 @@
services.openssh = {
enable = true;
openFirewall = false;
settings = {
# Forbid root login through SSH.
PermitRootLogin = null;
hosts/imxyy-nix/net.nix
+14 -40
View File
@@ -43,49 +43,22 @@
"192.168.3.2"
];
firewall.enable = false;
nftables = {
firewall = {
enable = true;
flushRuleset = true;
ruleset = ''
table inet firewall {
set LANv4 {
type ipv4_addr
flags interval
elements = { 10.0.0.0/8, 100.64.0.0/10, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16 }
}
set LANv6 {
type ipv6_addr
flags interval
elements = { fd00::/8, fe80::/10 }
}
chain output {
type filter hook output priority 100; policy accept;
}
chain input {
type filter hook input priority 0; policy drop;
iif lo accept
iifname waydroid0 accept
ct state invalid drop
ct state established,related accept
ip saddr @LANv4 accept
ip6 saddr @LANv6 accept
}
chain forward {
type filter hook forward priority 0; policy drop;
iifname waydroid0 accept
oifname waydroid0 accept
}
}
checkReversePath = false;
allowPing = false;
trustedInterfaces = [ "waydroid0" ];
extraInputRules = ''
ip saddr { 10.0.0.0/8, 100.64.0.0/10, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16 } accept
ip6 saddr { fd00::/8, fe80::/10 } accept
'';
filterForward = true;
extraForwardRules = ''
iifname waydroid0 accept
oifname waydroid0 accept
'';
};
nftables.enable = true;
};
sops.secrets.dae-imxyy-nix = {
@@ -96,6 +69,7 @@
services.dae = {
enable = true;
configFile = config.sops.secrets.dae-imxyy-nix.path;
openFirewall.enable = false;
};
systemd.services.dae.after = [ "sops-nix.service" ];
sops.secrets.mihomo = {
hosts/imxyy-nix/nixos.nix
+1
View File
@@ -78,6 +78,7 @@ in
};
services.openssh = {
enable = true;
openFirewall = false;
settings = {
# Forbid root login through SSH.
PermitRootLogin = null;