home/nixos-servers
home/nixos-servers
2
0
Fork 0
Code Issues 8 Pull requests Projects Releases Packages Wiki Activity Actions

add firewall!

Browse source
This commit is contained in:
Pim Kunis 2023-11-08 21:16:51 +01:00
parent a95ef6b212
commit 840628740b
2 changed files with 33 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
configuration.nix
View file

@ -83,12 +83,13 @@
python3
];
# TODO: firewalling
# Open ports in the firewall.
# networking.firewall.allowedTCPPorts = [ ... ];
# networking.firewall.allowedUDPPorts = [ ... ];
# Or disable the firewall altogether.
# networking.firewall.enable = false;
networking.firewall.enable = false;
networking.nftables = {
enable = true;
checkRuleset = true;
ruleset = builtins.readFile ./nftables.conf;
};
system.stateVersion = "23.05";

26
nftables.conf Normal file
View file

@ -0,0 +1,26 @@
table inet nixos-fw {
chain rpfilter {
type filter hook prerouting priority mangle + 10; policy drop;
meta nfproto ipv4 udp sport . udp dport { 68 . 67, 67 . 68 } accept comment "DHCPv4 client/server"
fib saddr . mark . iif oif exists accept
}
chain input {
type filter hook input priority filter; policy drop;
iifname "lo" accept comment "trusted interfaces"
ct state vmap { invalid : drop, established : accept, related : accept, new : jump input-allow, untracked : jump input-allow }
tcp flags syn / fin,syn,rst,ack log prefix "refused connection: " level info
}
chain input-allow {
tcp dport 22 accept
icmp type echo-request accept comment "allow ping"
icmpv6 type != { nd-redirect, 139 } accept comment "Accept all ICMPv6 messages except redirects and node information queries (type 139). See RFC 4890, section 4.4."
ip6 daddr fe80::/64 udp dport 546 accept comment "DHCPv6 client"
}
chain forward-allow {
type filter hook forward priority filter; policy drop;
ip daddr 192.168.30.0/24 accept
}
}