2023-12-05 05:27:06 +01:00
|
|
|
{ config, lib, pkgs, ... }: {
|
2023-12-21 07:52:18 +01:00
|
|
|
networking = {
|
2023-12-21 08:01:40 +01:00
|
|
|
firewall = {
|
2024-01-12 02:42:54 +01:00
|
|
|
enable = true;
|
2023-12-21 08:01:40 +01:00
|
|
|
allowedTCPPorts = [
|
|
|
|
80 # HTTP
|
|
|
|
443 # HTTPS
|
|
|
|
42420 # Vintage Story
|
|
|
|
25565 # Minecraft
|
2023-12-23 10:33:55 +01:00
|
|
|
1443 # Headscale DERP (tcp)
|
2024-03-11 06:38:32 +01:00
|
|
|
25 # Mailserver
|
|
|
|
143 # Mailserver
|
|
|
|
465 # Mailserver
|
|
|
|
587 # Mailserver
|
|
|
|
993 # Mailserver
|
|
|
|
4190 # Mailserver
|
|
|
|
4443 # Jitsi
|
2023-12-21 08:01:40 +01:00
|
|
|
];
|
2023-12-21 08:22:56 +01:00
|
|
|
allowedUDPPorts = [
|
2023-12-23 10:33:55 +01:00
|
|
|
3478 # Headscale DERP (udp)
|
2023-12-24 10:48:05 +01:00
|
|
|
10000 # Jitsi Meet (udp)
|
2023-12-21 08:22:56 +01:00
|
|
|
];
|
2024-01-12 02:41:26 +01:00
|
|
|
};
|
2023-12-21 08:01:40 +01:00
|
|
|
|
2023-12-21 07:52:18 +01:00
|
|
|
nftables = {
|
|
|
|
enable = true;
|
|
|
|
ruleset = ''
|
|
|
|
table ip nat {
|
|
|
|
chain PREROUTING {
|
2024-01-12 03:00:56 +01:00
|
|
|
type nat hook prerouting priority dstnat; policy accept;
|
2024-01-12 02:47:45 +01:00
|
|
|
iifname "enp0s4" tcp dport 25 dnat to 10.100.0.2:25; # Mailserver
|
|
|
|
iifname "enp0s4" tcp dport 143 dnat to 10.100.0.2:143; # Mailserver
|
|
|
|
iifname "enp0s4" tcp dport 465 dnat to 10.100.0.2:465; # Mailserver
|
|
|
|
iifname "enp0s4" tcp dport 587 dnat to 10.100.0.2:587; # Mailserver
|
|
|
|
iifname "enp0s4" tcp dport 993 dnat to 10.100.0.2:993; # Mailserver
|
|
|
|
iifname "enp0s4" tcp dport 4190 dnat to 10.100.0.2:4190; # Mailserver
|
2023-12-21 08:01:40 +01:00
|
|
|
iifname "enp0s4" tcp dport 80 dnat to 10.100.0.2:80; # HTTP
|
|
|
|
iifname "enp0s4" tcp dport 443 dnat to 10.100.0.2:443; # HTTPS
|
|
|
|
iifname "enp0s4" tcp dport 42420 dnat to 10.100.0.2:42420; # Vintage Story
|
|
|
|
iifname "enp0s4" tcp dport 25565 dnat to 10.100.0.2:25565; # Minecraft
|
2024-03-11 06:03:19 +01:00
|
|
|
iifname "enp0s4" tcp dport 4443 dnat to 10.100.0.2:4443; # Jitsi
|
2023-12-21 07:52:18 +01:00
|
|
|
}
|
|
|
|
}
|
|
|
|
'';
|
|
|
|
};
|
2023-12-21 08:01:40 +01:00
|
|
|
|
2023-12-21 07:52:18 +01:00
|
|
|
nat = {
|
|
|
|
enable = true;
|
2023-12-21 08:21:40 +01:00
|
|
|
internalInterfaces = [ "enp0s4" ];
|
|
|
|
externalInterface = "wireguard0";
|
2023-12-21 07:52:18 +01:00
|
|
|
forwardPorts = [
|
2024-01-12 02:47:45 +01:00
|
|
|
{ sourcePort = 25; proto = "tcp"; destination = "10.100.0.2:25"; } # Mailserver
|
|
|
|
{ sourcePort = 143; proto = "tcp"; destination = "10.100.0.2:143"; } # Mailserver
|
|
|
|
{ sourcePort = 465; proto = "tcp"; destination = "10.100.0.2:465"; } # Mailserver
|
|
|
|
{ sourcePort = 587; proto = "tcp"; destination = "10.100.0.2:587"; } # Mailserver
|
|
|
|
{ sourcePort = 993; proto = "tcp"; destination = "10.100.0.2:993"; } # Mailserver
|
|
|
|
{ sourcePort = 4190; proto = "tcp"; destination = "10.100.0.2:4190"; } # Mailserver
|
2023-12-23 02:09:33 +01:00
|
|
|
{ sourcePort = 80; proto = "tcp"; destination = "10.100.0.2:80"; } # HTTP
|
|
|
|
{ sourcePort = 443; proto = "tcp"; destination = "10.100.0.2:443"; } # HTTPS
|
|
|
|
{ sourcePort = 42420; proto = "tcp"; destination = "10.100.0.2:42420"; } # Vintage Story
|
|
|
|
{ sourcePort = 25565; proto = "tcp"; destination = "10.100.0.2:25565"; } # Minecraft
|
2024-01-14 05:12:56 +01:00
|
|
|
{ sourcePort = 4443; proto = "tcp"; destination = "10.100.0.2:4443"; } # Jitsi
|
2023-12-21 07:52:18 +01:00
|
|
|
];
|
|
|
|
};
|
2023-12-21 06:55:58 +01:00
|
|
|
};
|
2024-03-11 06:03:19 +01:00
|
|
|
}
|