nix/nixos/hosts/osaka-linode-01/firewall.nix

47 lines
1.8 KiB
Nix
Raw Normal View History

2023-12-05 05:27:06 +01:00
{ config, lib, pkgs, ... }: {
2023-12-21 07:52:18 +01:00
networking = {
2023-12-21 08:01:40 +01:00
firewall = {
allowedTCPPorts = [
80 # HTTP
443 # HTTPS
42420 # Vintage Story
25565 # Minecraft
1443 # Headscale DERP
];
2023-12-21 08:22:56 +01:00
allowedUDPPorts = [
3478 # Headscale DERP UDP
];
2023-12-21 08:01:40 +01:00
};
2023-12-21 07:52:18 +01:00
nftables = {
enable = true;
ruleset = ''
table ip nat {
chain PREROUTING {
type nat hook prerouting priority dstnat; policy accept;
2023-12-21 08:01:40 +01:00
iifname "enp0s4" tcp dport 80 dnat to 10.100.0.2:80; # HTTP
iifname "enp0s4" tcp dport 443 dnat to 10.100.0.2:443; # HTTPS
iifname "enp0s4" tcp dport 42420 dnat to 10.100.0.2:42420; # Vintage Story
iifname "enp0s4" tcp dport 25565 dnat to 10.100.0.2:25565; # Minecraft
iifname "enp0s4" tcp dport 1443 dnat to 10.100.0.2:1443; # Headscale DERP (tcp)
2023-12-21 08:21:28 +01:00
iifname "enp0s4" udp dport 3478 dnat to 10.100.0.2:3478; # Headscale DERP (udp)
2023-12-21 07:52:18 +01:00
}
}
'';
};
2023-12-21 08:01:40 +01:00
2023-12-21 07:52:18 +01:00
nat = {
enable = true;
2023-12-21 08:21:40 +01:00
internalInterfaces = [ "enp0s4" ];
externalInterface = "wireguard0";
2023-12-21 07:52:18 +01:00
forwardPorts = [
2023-12-21 08:21:28 +01:00
{ destination = "10.100.0.2:80"; proto = "tcp"; sourcePort = 80; } # HTTP
{ destination = "10.100.0.2:443"; proto = "tcp"; sourcePort = 443; } # HTTPS
{ destination = "10.100.0.2:42420"; proto = "tcp"; sourcePort = 42420; } # Vintage Story
{ destination = "10.100.0.2:25565"; proto = "tcp"; sourcePort = 25565; } # Minecraft
{ destination = "10.100.0.2:1443"; proto = "tcp"; sourcePort = 1443; } # Headscale DERP (tcp)
{ destination = "10.100.0.2:3478"; proto = "udp"; sourcePort = 3478; } # Headscale DERP (udp)
2023-12-21 07:52:18 +01:00
];
};
2023-12-21 06:55:58 +01:00
};
2023-12-05 05:27:06 +01:00
}