hacc/haccfiles
8
0
Fork 1
Code Issues 1 Pull requests Projects Releases Wiki Activity

use networking.firewall instead of nftables.ruleset

Browse source
This commit is contained in:
Moira 2024-04-07 15:57:51 +02:00
parent 5e51d5f252
commit 1ad0a7751c
1 changed files with 12 additions and 61 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

73
parsons/nftables.nix
View file

@ -1,7 +1,7 @@
{ config, lib, pkgs, ... }: { config, lib, pkgs, ... }:
{ {
networking.firewall.enable = false; networking.firewall.enable = true;
networking.nat.enable = false; networking.nat.enable = false;
boot = { boot = {
kernelModules = [ "nf_nat_ftp" ]; kernelModules = [ "nf_nat_ftp" ];
@ -11,67 +11,18 @@
}; };
}; };
networking.nftables = { networking.nftables.enable = true;
enable = true; networking.nftables.tables.nat = {
family = "ip";
ruleset = '' content = ''
table inet filter { chain prerouting {
chain input { type nat hook prerouting priority -100
type filter hook input priority filter iifname enp35s0 tcp dport { 22 } dnat ${config.containers.forgejo.localAddress}:22
policy drop
icmpv6 type {
echo-request,
echo-reply,
mld-listener-query,
mld-listener-report,
mld-listener-done,
nd-router-advert,
nd-neighbor-solicit,
nd-neighbor-advert,
packet-too-big
} accept
icmp type echo-request accept
ct state invalid drop
ct state established,related accept
iifname { lo } accept
tcp dport { 25, 80, 443, 465, 587, 993, 4190, 62954, 64738 } accept
udp dport { 60000-61000, 64738 } accept
# DHCPv6
ip6 daddr fe80::/64 udp dport 546 accept
counter
}
chain output {
type filter hook output priority filter
policy accept
counter
}
chain forward {
type filter hook forward priority filter
policy accept
counter
}
} }
chain postrouting {
table ip nat { type nat hook postrouting priority 100
chain prerouting { iifname lxcbr0 oifname enp35s0 masquerade
type nat hook prerouting priority -100 iifname ve-* oifname enp35s0 masquerade
iifname enp35s0 tcp dport { 22 } dnat ${config.containers.forgejo.localAddress}:22
}
chain postrouting {
type nat hook postrouting priority 100
iifname lxcbr0 oifname enp35s0 masquerade
iifname ve-* oifname enp35s0 masquerade
}
} }
''; '';
}; };