stuebinm
7b9e423999
mostly just replacing strings to avoid confusion later on. Since our containers are now ephemeral, renaming them is basically a non-issue (though the files under /persist/containers & the uffd client name had to be changed manually)
78 lines
1.8 KiB
Nix
78 lines
1.8 KiB
Nix
{ config, lib, pkgs, ... }:
|
|
|
|
{
|
|
networking.firewall.enable = false;
|
|
networking.nat.enable = false;
|
|
boot = {
|
|
kernelModules = [ "nf_nat_ftp" ];
|
|
kernel.sysctl = {
|
|
"net.ipv4.conf.all.forwarding" = true;
|
|
"net.ipv4.conf.default.forwarding" = true;
|
|
};
|
|
};
|
|
|
|
networking.nftables = {
|
|
enable = true;
|
|
|
|
ruleset = ''
|
|
table inet filter {
|
|
chain input {
|
|
type filter hook input priority filter
|
|
policy drop
|
|
|
|
icmpv6 type {
|
|
echo-request,
|
|
echo-reply,
|
|
mld-listener-query,
|
|
mld-listener-report,
|
|
mld-listener-done,
|
|
nd-router-advert,
|
|
nd-neighbor-solicit,
|
|
nd-neighbor-advert,
|
|
packet-too-big
|
|
} accept
|
|
|
|
icmp type echo-request accept
|
|
|
|
ct state invalid drop
|
|
ct state established,related accept
|
|
|
|
iifname { lo } accept
|
|
|
|
tcp dport { 25, 80, 443, 465, 587, 993, 4190, 62954, 64738 } accept
|
|
|
|
udp dport { 60000-61000, 64738 } accept
|
|
|
|
# DHCPv6
|
|
ip6 daddr fe80::/64 udp dport 546 accept
|
|
|
|
counter
|
|
}
|
|
chain output {
|
|
type filter hook output priority filter
|
|
policy accept
|
|
|
|
counter
|
|
}
|
|
chain forward {
|
|
type filter hook forward priority filter
|
|
policy accept
|
|
|
|
counter
|
|
}
|
|
}
|
|
|
|
table ip nat {
|
|
chain prerouting {
|
|
type nat hook prerouting priority -100
|
|
iifname enp35s0 tcp dport { 22 } dnat ${config.containers.forgejo.localAddress}:22
|
|
}
|
|
chain postrouting {
|
|
type nat hook postrouting priority 100
|
|
iifname lxcbr0 oifname enp35s0 masquerade
|
|
iifname ve-* oifname enp35s0 masquerade
|
|
}
|
|
}
|
|
'';
|
|
};
|
|
}
|