From fef9f79a78f9faf35b46613f3e5a18afda1a2d94 Mon Sep 17 00:00:00 2001 From: imxyy_soope_ Date: Mon, 27 Jul 2026 15:28:48 +0800 Subject: [PATCH] net: switch from manual nftables to firewall module --- hosts/imxyy-nix-server/net.nix | 87 ++++++++-------------------------- hosts/imxyy-nix-x16/net.nix | 45 ++++-------------- hosts/imxyy-nix-x16/nixos.nix | 1 + hosts/imxyy-nix/net.nix | 54 ++++++--------------- hosts/imxyy-nix/nixos.nix | 1 + 5 files changed, 44 insertions(+), 144 deletions(-) diff --git a/hosts/imxyy-nix-server/net.nix b/hosts/imxyy-nix-server/net.nix index 9225996..f202cc1 100644 --- a/hosts/imxyy-nix-server/net.nix +++ b/hosts/imxyy-nix-server/net.nix @@ -47,81 +47,31 @@ "192.168.3.2" ]; - firewall.enable = false; - nftables = { + firewall = { enable = true; - flushRuleset = true; - ruleset = '' - table inet firewall { - set LANv4 { - type ipv4_addr - flags interval - - elements = { 10.0.0.0/8, 100.64.0.0/10, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16 } - } - set LANv6 { - type ipv6_addr - flags interval - - elements = { fd00::/8, fe80::/10 } - } - set tcp_ports { - type inet_service - flags interval - - elements = { - http, - https, - 2222, - 25565 - } - } - - chain prerouting { - type filter hook prerouting priority mangle; policy accept; - - ip daddr @LANv4 accept - ip6 daddr @LANv6 accept - } - - chain output { - type filter hook output priority 100; policy accept; - - ip daddr @LANv4 accept - ip6 daddr @LANv6 accept - } - - chain input { - type filter hook input priority 0; policy drop; - iif lo accept - ct state invalid drop - ct state established,related accept - - ip protocol { icmp, igmp } accept - - ip saddr @LANv4 accept - ip6 saddr @LANv6 accept - - tcp dport 2222 ct state new limit rate 15/minute counter accept - - tcp dport @tcp_ports counter accept - } - - chain forward { - type filter hook forward priority 0; policy accept; - } - - chain nat { - type nat hook postrouting priority 0; policy accept; - ip saddr 192.168.3.0/24 masquerade - } - } + checkReversePath = false; + allowedTCPPorts = [ + 80 + 443 + 2222 + ]; + extraInputRules = '' + ip saddr { 10.0.0.0/8, 100.64.0.0/10, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16 } accept + ip6 saddr { fd00::/8, fe80::/10 } accept ''; + filterForward = false; + }; + nftables.enable = true; + nat = { + enable = true; + externalInterface = "mac0"; + internalIPs = [ "192.168.3.0/24" ]; }; }; services.openssh = { enable = true; + openFirewall = false; settings = { # PermitRootLogin = "yes"; PermitRootLogin = "prohibit-password"; @@ -143,6 +93,7 @@ services.dae = { enable = true; configFile = config.sops.secrets.dae-imxyy-nix-server.path; + openFirewall.enable = false; }; systemd.services.dae = { after = [ "sops-nix.service" ]; diff --git a/hosts/imxyy-nix-x16/net.nix b/hosts/imxyy-nix-x16/net.nix index 1db583f..2acfd76 100644 --- a/hosts/imxyy-nix-x16/net.nix +++ b/hosts/imxyy-nix-x16/net.nix @@ -12,45 +12,17 @@ my.persist.nixosDirs = [ "/etc/NetworkManager/system-connections" ]; networking = { networkmanager.enable = true; - firewall.enable = false; - nftables = { + firewall = { enable = true; - flushRuleset = true; - ruleset = '' - table inet firewall { - set LANv4 { - type ipv4_addr - flags interval - - elements = { 10.0.0.0/8, 100.64.0.0/10, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16 } - } - set LANv6 { - type ipv6_addr - flags interval - - elements = { fd00::/8, fe80::/10 } - } - - chain output { - type filter hook output priority 100; policy accept; - } - - chain input { - type filter hook input priority 0; policy drop; - iif lo accept - ct state invalid drop - ct state established,related accept - - ip saddr @LANv4 accept - ip6 saddr @LANv6 accept - } - - chain forward { - type filter hook forward priority 0; policy drop; - } - } + checkReversePath = false; + allowPing = false; + extraInputRules = '' + ip saddr { 10.0.0.0/8, 100.64.0.0/10, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16 } accept + ip6 saddr { fd00::/8, fe80::/10 } accept ''; + filterForward = true; }; + nftables.enable = true; }; sops.secrets.dae-imxyy-nix-x16 = { @@ -61,6 +33,7 @@ services.dae = { enable = true; configFile = config.sops.secrets.dae-imxyy-nix-x16.path; + openFirewall.enable = false; }; systemd.services.dae.after = [ "sops-nix.service" ]; sops.secrets.mihomo = { diff --git a/hosts/imxyy-nix-x16/nixos.nix b/hosts/imxyy-nix-x16/nixos.nix index bf6b33b..4348d15 100644 --- a/hosts/imxyy-nix-x16/nixos.nix +++ b/hosts/imxyy-nix-x16/nixos.nix @@ -31,6 +31,7 @@ services.openssh = { enable = true; + openFirewall = false; settings = { # Forbid root login through SSH. PermitRootLogin = null; diff --git a/hosts/imxyy-nix/net.nix b/hosts/imxyy-nix/net.nix index 635de98..22b1877 100644 --- a/hosts/imxyy-nix/net.nix +++ b/hosts/imxyy-nix/net.nix @@ -43,49 +43,22 @@ "192.168.3.2" ]; - firewall.enable = false; - nftables = { + firewall = { enable = true; - flushRuleset = true; - ruleset = '' - table inet firewall { - set LANv4 { - type ipv4_addr - flags interval - - elements = { 10.0.0.0/8, 100.64.0.0/10, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16 } - } - set LANv6 { - type ipv6_addr - flags interval - - elements = { fd00::/8, fe80::/10 } - } - - chain output { - type filter hook output priority 100; policy accept; - } - - chain input { - type filter hook input priority 0; policy drop; - iif lo accept - iifname waydroid0 accept - ct state invalid drop - ct state established,related accept - - ip saddr @LANv4 accept - ip6 saddr @LANv6 accept - } - - chain forward { - type filter hook forward priority 0; policy drop; - - iifname waydroid0 accept - oifname waydroid0 accept - } - } + checkReversePath = false; + allowPing = false; + trustedInterfaces = [ "waydroid0" ]; + extraInputRules = '' + ip saddr { 10.0.0.0/8, 100.64.0.0/10, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16 } accept + ip6 saddr { fd00::/8, fe80::/10 } accept + ''; + filterForward = true; + extraForwardRules = '' + iifname waydroid0 accept + oifname waydroid0 accept ''; }; + nftables.enable = true; }; sops.secrets.dae-imxyy-nix = { @@ -96,6 +69,7 @@ services.dae = { enable = true; configFile = config.sops.secrets.dae-imxyy-nix.path; + openFirewall.enable = false; }; systemd.services.dae.after = [ "sops-nix.service" ]; sops.secrets.mihomo = { diff --git a/hosts/imxyy-nix/nixos.nix b/hosts/imxyy-nix/nixos.nix index 9c630c5..6f31874 100644 --- a/hosts/imxyy-nix/nixos.nix +++ b/hosts/imxyy-nix/nixos.nix @@ -78,6 +78,7 @@ in }; services.openssh = { enable = true; + openFirewall = false; settings = { # Forbid root login through SSH. PermitRootLogin = null;