albert/nix
albert/nix
1
0
Fork 0
Code Issues Pull requests Activity Actions

Udpate firewall / iptables rules

Browse source
This commit is contained in:
albert 2025-03-23 12:51:20 +01:00
parent a5d862883b
commit 5f8eaf6029
Signed by: albert
GPG key ID: 3895DD267CA11BA9
1 changed files with 25 additions and 17 deletions

42
nixos/hosts/frankfurt-linode-01/firewall.nix
View file

@ -1,4 +1,11 @@
{ pkgs, ... }: { { pkgs, ... }:
let
wg-framework-server = "10.100.0.2";
wg-enshrouded = "10.100.1.2";
wg-mailserver = "10.100.1.3";
wg-vintage-story = "10.100.1.5";
wg-rust = "10.100.1.6";
in {
networking = { networking = {
firewall = { firewall = {
enable = true; enable = true;
@ -29,15 +36,16 @@
nftables = { nftables = {
enable = true; enable = true;
# iifname "enp0s4" udp dport 15636 dnat to ${wg-enshrouded}:15636;
# iifname "enp0s4" udp dport 15637 dnat to ${wg-enshrouded}:15637;
ruleset = '' ruleset = ''
table ip nat { table ip nat {
chain PREROUTING { chain PREROUTING {
type nat hook prerouting priority dstnat; policy accept; type nat hook prerouting priority dstnat; policy accept;
iifname "enp0s4" udp dport 10000 dnat to 10.100.0.2:10000; iifname "enp0s4" udp dport 10000 dnat to ${wg-framework-server}:10000;
iifname "enp0s4" udp dport 15636 dnat to 10.100.1.2:15636; iifname "enp0s4" udp dport 20815 dnat to ${wg-rust}:20815;
iifname "enp0s4" udp dport 15637 dnat to 10.100.1.2:15637; iifname "enp0s4" udp dport 20816 dnat to ${wg-rust}:20816;
iifname "enp0s4" udp dport 20815 dnat to 10.100.1.3:20815;
iifname "enp0s4" udp dport 20816 dnat to 10.100.1.3:20816;
} }
} }
''; '';
@ -48,11 +56,11 @@
internalInterfaces = [ "enp0s4" ]; internalInterfaces = [ "enp0s4" ];
externalInterface = "wireguard0"; externalInterface = "wireguard0";
forwardPorts = [ forwardPorts = [
{ sourcePort = 10000; proto = "udp"; destination = "10.100.0.2:10000"; } # Jitsi Meet { sourcePort = 10000; proto = "udp"; destination = "${wg-framework-server}:10000"; } # Jitsi Meet
{ sourcePort = 15636; proto = "udp"; destination = "10.100.1.2:15636"; } # Enshrouded # { sourcePort = 15636; proto = "udp"; destination = "${wg-enshrouded}:15636"; } # Enshrouded
{ sourcePort = 15637; proto = "udp"; destination = "10.100.1.2:15637"; } # Enshrouded # { sourcePort = 15637; proto = "udp"; destination = "${wg-enshrouded}:15637"; } # Enshrouded
{ sourcePort = 20815; proto = "udp"; destination = "10.100.1.3:20816"; } # Rust { sourcePort = 20815; proto = "udp"; destination = "${wg-rust}:20816"; } # Rust
{ sourcePort = 20816; proto = "udp"; destination = "10.100.1.3:20816"; } # Rust { sourcePort = 20816; proto = "udp"; destination = "${wg-rust}:20816"; } # Rust
]; ];
}; };
}; };
@ -83,8 +91,8 @@
mode http mode http
option forwardfor option forwardfor
option forwarded option forwarded
# server framework-server 10.100.0.2:443 ssl verify required ca-file ${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt sni req.hdr(Host) # server framework-server ${wg-framework-server}:443 ssl verify required ca-file ${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt sni req.hdr(Host)
server framework-server 10.100.0.2 server framework-server ${wg-framework-server}
frontend tcp frontend tcp
mode tcp mode tcp
@ -97,7 +105,7 @@
default_backend backend_tcp default_backend backend_tcp
backend backend_tcp backend backend_tcp
mode tcp mode tcp
server framework-server 10.100.0.2 server framework-server ${wg-framework-server}
frontend mail frontend mail
mode tcp mode tcp
@ -110,7 +118,7 @@
default_backend backend_mail default_backend backend_mail
backend backend_mail backend backend_mail
mode tcp mode tcp
server mailserver-wg 10.100.1.3 server mailserver-wg ${wg-mailserver}
frontend vintage-story frontend vintage-story
mode tcp mode tcp
@ -118,7 +126,7 @@
default_backend backend_vintage-story default_backend backend_vintage-story
backend backend_vintage-story backend backend_vintage-story
mode tcp mode tcp
server vintage-story-wg 10.100.1.5 server vintage-story-wg ${wg-vintage-story}
frontend rust frontend rust
mode tcp mode tcp
@ -127,7 +135,7 @@
default_backend backend_rust default_backend backend_rust
backend backend_rust backend backend_rust
mode tcp mode tcp
server rust-wg 1.100.1.6 server rust-wg ${wg-rust}
''; '';
}; };