2023-12-05 05:27:06 +01:00
|
|
|
{ config, lib, pkgs, ... }: {
|
2023-12-21 07:52:18 +01:00
|
|
|
networking = {
|
2023-12-21 08:01:40 +01:00
|
|
|
firewall = {
|
|
|
|
allowedTCPPorts = [
|
|
|
|
80 # HTTP
|
|
|
|
443 # HTTPS
|
|
|
|
42420 # Vintage Story
|
|
|
|
25565 # Minecraft
|
2023-12-23 10:33:55 +01:00
|
|
|
1443 # Headscale DERP (tcp)
|
2024-01-10 12:49:43 +01:00
|
|
|
25 # Mailserver
|
|
|
|
143 # Mailserver
|
|
|
|
465 # Mailserver
|
|
|
|
587 # Mailserver
|
|
|
|
993 # Mailserver
|
|
|
|
4190 # Mailserver
|
2023-12-21 08:01:40 +01:00
|
|
|
];
|
2023-12-21 08:22:56 +01:00
|
|
|
allowedUDPPorts = [
|
2023-12-23 10:33:55 +01:00
|
|
|
3478 # Headscale DERP (udp)
|
2023-12-24 10:48:05 +01:00
|
|
|
10000 # Jitsi Meet (udp)
|
2023-12-21 08:22:56 +01:00
|
|
|
];
|
2023-12-21 08:01:40 +01:00
|
|
|
};
|
|
|
|
|
2023-12-21 07:52:18 +01:00
|
|
|
nftables = {
|
|
|
|
enable = true;
|
|
|
|
ruleset = ''
|
|
|
|
table ip nat {
|
|
|
|
chain PREROUTING {
|
|
|
|
type nat hook prerouting priority dstnat; policy accept;
|
2023-12-21 08:01:40 +01:00
|
|
|
iifname "enp0s4" tcp dport 80 dnat to 10.100.0.2:80; # HTTP
|
|
|
|
iifname "enp0s4" tcp dport 443 dnat to 10.100.0.2:443; # HTTPS
|
|
|
|
iifname "enp0s4" tcp dport 42420 dnat to 10.100.0.2:42420; # Vintage Story
|
|
|
|
iifname "enp0s4" tcp dport 25565 dnat to 10.100.0.2:25565; # Minecraft
|
|
|
|
iifname "enp0s4" tcp dport 1443 dnat to 10.100.0.2:1443; # Headscale DERP (tcp)
|
2023-12-21 08:21:28 +01:00
|
|
|
iifname "enp0s4" udp dport 3478 dnat to 10.100.0.2:3478; # Headscale DERP (udp)
|
2023-12-24 10:48:05 +01:00
|
|
|
iifname "enp0s4" udp dport 10000 dnat to 10.100.0.2:10000; # Headscale DERP (udp)
|
2024-01-10 12:49:43 +01:00
|
|
|
iifname "enp0s4" tcp dport 25 dnat to 10.100.0.2:25; # Mailserver
|
|
|
|
iifname "enp0s4" tcp dport 143 dnat to 10.100.0.2:143; # Mailserver
|
|
|
|
iifname "enp0s4" tcp dport 465 dnat to 10.100.0.2:465; # Mailserver
|
|
|
|
iifname "enp0s4" tcp dport 587 dnat to 10.100.0.2:587; # Mailserver
|
|
|
|
iifname "enp0s4" tcp dport 993 dnat to 10.100.0.2:993; # Mailserver
|
|
|
|
iifname "enp0s4" tcp dport 4190 dnat to 10.100.0.2:419; # Mailserver
|
2023-12-21 07:52:18 +01:00
|
|
|
}
|
|
|
|
}
|
|
|
|
'';
|
|
|
|
};
|
2023-12-21 08:01:40 +01:00
|
|
|
|
2023-12-21 07:52:18 +01:00
|
|
|
nat = {
|
|
|
|
enable = true;
|
2023-12-21 08:21:40 +01:00
|
|
|
internalInterfaces = [ "enp0s4" ];
|
|
|
|
externalInterface = "wireguard0";
|
2023-12-21 07:52:18 +01:00
|
|
|
forwardPorts = [
|
2023-12-23 02:09:33 +01:00
|
|
|
{ sourcePort = 80; proto = "tcp"; destination = "10.100.0.2:80"; } # HTTP
|
|
|
|
{ sourcePort = 443; proto = "tcp"; destination = "10.100.0.2:443"; } # HTTPS
|
|
|
|
{ sourcePort = 42420; proto = "tcp"; destination = "10.100.0.2:42420"; } # Vintage Story
|
|
|
|
{ sourcePort = 25565; proto = "tcp"; destination = "10.100.0.2:25565"; } # Minecraft
|
|
|
|
{ sourcePort = 1443; proto = "tcp"; destination = "10.100.0.2:1443"; } # Headscale DERP (tcp)
|
|
|
|
{ sourcePort = 3478; proto = "udp"; destination = "10.100.0.2:3478"; } # Headscale DERP (udp)
|
2023-12-24 10:48:05 +01:00
|
|
|
{ sourcePort = 10000; proto = "udp"; destination = "10.100.0.2:10000"; } # Headscale DERP (udp)
|
2024-01-11 03:55:05 +01:00
|
|
|
{ sourcePort = 25; proto = "tcp"; destination = "10.100.0.2:25"; } # Mailserver
|
|
|
|
{ sourcePort = 143; proto = "tcp"; destination = "10.100.0.2:143"; } # Mailserver
|
|
|
|
{ sourcePort = 465; proto = "tcp"; destination = "10.100.0.2:465"; } # Mailserver
|
|
|
|
{ sourcePort = 587; proto = "tcp"; destination = "10.100.0.2:587"; } # Mailserver
|
|
|
|
{ sourcePort = 993; proto = "tcp"; destination = "10.100.0.2:993"; } # Mailserver
|
|
|
|
{ sourcePort = 4190; proto = "tcp"; destination = "10.100.0.2:4190"; } # Mailserver
|
2023-12-21 07:52:18 +01:00
|
|
|
];
|
|
|
|
};
|
2023-12-21 06:55:58 +01:00
|
|
|
};
|
2023-12-05 05:27:06 +01:00
|
|
|
}
|