hacc/haccfiles
8
0
Fork 1
Code Issues 1 Pull requests Projects Releases Wiki Activity

format nftables.nix

Browse source
This commit is contained in:
stuebinm 2024-02-25 17:53:54 +01:00
parent e12cc7dbf5
commit f29830ec93
1 changed files with 56 additions and 58 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

36
parsons/nftables.nix
View file

@ -15,12 +15,23 @@
enable = true; enable = true;
ruleset = '' ruleset = ''
table inet filter { table inet filter {
chain input { chain input {
type filter hook input priority filter type filter hook input priority filter
policy drop policy drop
icmpv6 type { echo-request, echo-reply, mld-listener-query, mld-listener-report, mld-listener-done, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert, packet-too-big } accept icmpv6 type {
echo-request,
echo-reply,
mld-listener-query,
mld-listener-report,
mld-listener-done,
nd-router-advert,
nd-neighbor-solicit,
nd-neighbor-advert,
packet-too-big
} accept
icmp type echo-request accept icmp type echo-request accept
ct state invalid drop ct state invalid drop
@ -32,37 +43,26 @@ table inet filter {
udp dport { 60000-61000, 64738 } accept udp dport { 60000-61000, 64738 } accept
# DHCPv6 # DHCPv6
ip6 daddr fe80::/64 udp dport 546 accept ip6 daddr fe80::/64 udp dport 546 accept
counter counter
} }
chain output { chain output {
type filter hook output priority filter type filter hook output priority filter
policy accept policy accept
counter counter
} }
chain forward { chain forward {
type filter hook forward priority filter type filter hook forward priority filter
policy accept policy accept
counter counter
} }
} }
table ip nat { table ip nat {
chain prerouting { chain prerouting {
type nat hook prerouting priority -100 type nat hook prerouting priority -100
iifname enp35s0 tcp dport { 22 } dnat ${config.containers.gitea.localAddress}:22 iifname enp35s0 tcp dport { 22 } dnat ${config.containers.gitea.localAddress}:22
@ -70,11 +70,9 @@ table ip nat {
chain postrouting { chain postrouting {
type nat hook postrouting priority 100 type nat hook postrouting priority 100
iifname lxcbr0 oifname enp35s0 masquerade iifname lxcbr0 oifname enp35s0 masquerade
iifname ve-* oifname enp35s0 masquerade iifname ve-* oifname enp35s0 masquerade
}
} }
}
''; '';
}; };
} }