net: switch from manual nftables to firewall module

flake/overlays/default.nix

@@ -19,8 +19,6 @@ in
       cage.__output.patches.__append = [ ./cage-specify-output-name.patch ];
       bottles.__input.removeWarningPopup.__assign = true;
 
-      easytier.__assign = final.stable.easytier;
-
       niri-unstable.__input.libdisplay-info.__assign = final.unstable-small.libdisplay-info_0_3;
     }
   )

hosts/imxyy-nix-server/net.nix

@@ -47,81 +47,31 @@
       "192.168.3.2"
     ];
 
-    firewall.enable = false;
+    firewall = {
-    nftables = {
       enable = true;
-      flushRuleset = true;
+      checkReversePath = false;
-      ruleset = ''
+      allowedTCPPorts = [
-        table inet firewall {
+        80
-          set LANv4 {
+        443
-            type ipv4_addr
+        2222
-            flags interval
+      ];
-
+      extraInputRules = ''
-            elements = { 10.0.0.0/8, 100.64.0.0/10, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16 }
+        ip saddr { 10.0.0.0/8, 100.64.0.0/10, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16 } accept
-          }
+        ip6 saddr { fd00::/8, fe80::/10 } accept
-          set LANv6 {
-            type ipv6_addr
-            flags interval
-
-            elements = { fd00::/8, fe80::/10 }
-          }
-          set tcp_ports {
-            type inet_service
-            flags interval
-
-            elements = {
-              http,
-              https,
-              2222,
-              25565
-            }
-          }
-
-          chain prerouting {
-            type filter hook prerouting priority mangle; policy accept;
-
-            ip daddr @LANv4 accept
-            ip6 daddr @LANv6 accept
-          }
-
-          chain output {
-            type filter hook output priority 100; policy accept;
-
-            ip daddr @LANv4 accept
-            ip6 daddr @LANv6 accept
-          }
-
-          chain input {
-            type filter hook input priority 0; policy drop;
-            iif lo accept
-            ct state invalid drop
-            ct state established,related accept
-
-            ip protocol { icmp, igmp } accept
-
-            ip saddr @LANv4 accept
-            ip6 saddr @LANv6 accept
-
-            tcp dport 2222 ct state new limit rate 15/minute counter accept
-
-            tcp dport @tcp_ports counter accept
-          }
-
-          chain forward {
-            type filter hook forward priority 0; policy accept;
-          }
-
-          chain nat {
-            type nat hook postrouting priority 0; policy accept;
-            ip saddr 192.168.3.0/24 masquerade
-          }
-        }
       '';
+      filterForward = false;
+    };
+    nftables.enable = true;
+    nat = {
+      enable = true;
+      externalInterface = "mac0";
+      internalIPs = [ "192.168.3.0/24" ];
     };
   };
 
   services.openssh = {
     enable = true;
+    openFirewall = false;
     settings = {
       # PermitRootLogin = "yes";
       PermitRootLogin = "prohibit-password";
@@ -143,6 +93,7 @@
   services.dae = {
     enable = true;
     configFile = config.sops.secrets.dae-imxyy-nix-server.path;
+    openFirewall.enable = false;
   };
   systemd.services.dae = {
     after = [ "sops-nix.service" ];

hosts/imxyy-nix-x16/net.nix

@@ -12,45 +12,17 @@
   my.persist.nixosDirs = [ "/etc/NetworkManager/system-connections" ];
   networking = {
     networkmanager.enable = true;
-    firewall.enable = false;
+    firewall = {
-    nftables = {
       enable = true;
-      flushRuleset = true;
+      checkReversePath = false;
-      ruleset = ''
+      allowPing = false;
-        table inet firewall {
+      extraInputRules = ''
-          set LANv4 {
+        ip saddr { 10.0.0.0/8, 100.64.0.0/10, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16 } accept
-            type ipv4_addr
+        ip6 saddr { fd00::/8, fe80::/10 } accept
-            flags interval
-
-            elements = { 10.0.0.0/8, 100.64.0.0/10, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16 }
-          }
-          set LANv6 {
-            type ipv6_addr
-            flags interval
-
-            elements = { fd00::/8, fe80::/10 }
-          }
-
-          chain output {
-            type filter hook output priority 100; policy accept;
-          }
-
-          chain input {
-            type filter hook input priority 0; policy drop;
-            iif lo accept
-            ct state invalid drop
-            ct state established,related accept
-
-            ip saddr @LANv4 accept
-            ip6 saddr @LANv6 accept
-          }
-
-          chain forward {
-            type filter hook forward priority 0; policy drop;
-          }
-        }
       '';
+      filterForward = true;
     };
+    nftables.enable = true;
   };
 
   sops.secrets.dae-imxyy-nix-x16 = {
@@ -61,6 +33,7 @@
   services.dae = {
     enable = true;
     configFile = config.sops.secrets.dae-imxyy-nix-x16.path;
+    openFirewall.enable = false;
   };
   systemd.services.dae.after = [ "sops-nix.service" ];
   sops.secrets.mihomo = {

hosts/imxyy-nix-x16/nixos.nix

@@ -31,6 +31,7 @@
 
   services.openssh = {
     enable = true;
+    openFirewall = false;
     settings = {
       # Forbid root login through SSH.
       PermitRootLogin = null;

hosts/imxyy-nix/net.nix

@@ -43,49 +43,22 @@
       "192.168.3.2"
     ];
 
-    firewall.enable = false;
+    firewall = {
-    nftables = {
       enable = true;
-      flushRuleset = true;
+      checkReversePath = false;
-      ruleset = ''
+      allowPing = false;
-        table inet firewall {
+      trustedInterfaces = [ "waydroid0" ];
-          set LANv4 {
+      extraInputRules = ''
-            type ipv4_addr
+        ip saddr { 10.0.0.0/8, 100.64.0.0/10, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16 } accept
-            flags interval
+        ip6 saddr { fd00::/8, fe80::/10 } accept
-
+      '';
-            elements = { 10.0.0.0/8, 100.64.0.0/10, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16 }
+      filterForward = true;
-          }
+      extraForwardRules = ''
-          set LANv6 {
+        iifname waydroid0 accept
-            type ipv6_addr
+        oifname waydroid0 accept
-            flags interval
-
-            elements = { fd00::/8, fe80::/10 }
-          }
-
-          chain output {
-            type filter hook output priority 100; policy accept;
-          }
-
-          chain input {
-            type filter hook input priority 0; policy drop;
-            iif lo accept
-            iifname waydroid0 accept
-            ct state invalid drop
-            ct state established,related accept
-
-            ip saddr @LANv4 accept
-            ip6 saddr @LANv6 accept
-          }
-
-          chain forward {
-            type filter hook forward priority 0; policy drop;
-
-            iifname waydroid0 accept
-            oifname waydroid0 accept
-          }
-        }
       '';
     };
+    nftables.enable = true;
   };
 
   sops.secrets.dae-imxyy-nix = {
@@ -96,6 +69,7 @@
   services.dae = {
     enable = true;
     configFile = config.sops.secrets.dae-imxyy-nix.path;
+    openFirewall.enable = false;
   };
   systemd.services.dae.after = [ "sops-nix.service" ];
   sops.secrets.mihomo = {

hosts/imxyy-nix/nixos.nix

@@ -78,6 +78,7 @@ in
   };
   services.openssh = {
     enable = true;
+    openFirewall = false;
     settings = {
       # Forbid root login through SSH.
       PermitRootLogin = null;