{ config, lib, pkgs, ... }: with lib; let cfg = config.hacc.nftables.nat; nats = config.networking.nat; in { options.hacc.nftables.nat = { enable = mkEnableOption "Wrap NAT into nftables."; forwardPorts = mkOption { type = with types; listOf (submodule { options = { ports = mkOption { type = types.listOf (types.either types.int (types.strMatching "[[:digit:]]+-[[:digit:]]+")); }; destination = mkOption { type = types.str; example = "10.0.0.1"; }; proto = mkOption { type = types.str; default = "tcp"; example = "udp"; }; }; }); default = []; example = [{ ports = [ 8080 "9100-9200" ]; destination = "192.168.100.2"; proto = "udp"; }]; }; }; config = mkIf cfg.enable { networking.nat.enable = mkOverride 99 false; boot = { kernelModules = [ "nf_nat_ftp" ]; kernel.sysctl = { "net.ipv4.conf.all.forwarding" = mkOverride 90 true; "net.ipv4.conf.default.forwarding" = mkOverride 90 true; }; }; networking.nftables = { extraConfig = '' table ip nat { chain prerouting { type nat hook prerouting priority -100 ${concatMapStringsSep "\n" (rule: "iif ${nats.externalInterface} ${rule.proto} dport { ${concatStringsSep ", " (map (x: toString x) rule.ports)} } dnat ${rule.destination}") cfg.forwardPorts} } chain postrouting { type nat hook postrouting priority 100 ${concatMapStringsSep "\n" (iface: "iifname ${replaceStrings ["+"] ["*"] iface} oifname ${nats.externalInterface} masquerade") nats.internalInterfaces} ${concatMapStringsSep "\n" (addr: "ip saddr ${addr} oifname ${nats.externalInterface} masquerade") nats.internalIPs} } } ''; }; }; }