albert/nix
albert/nix
1
0
Fork 0
Code Issues Pull requests Activity Actions

Update

Browse source
This commit is contained in:
albert 2025-03-09 15:30:03 -07:00
parent f8f161e479
commit 9d2409a60c
Signed by: albert
GPG key ID: 3895DD267CA11BA9
1 changed files with 10 additions and 15 deletions

25
nixos/hosts/frankfurt-linode-01/firewall.nix
View file

@ -6,7 +6,7 @@
80 # HTTP 80 # HTTP
443 # HTTPS 443 # HTTPS
42420 # Vintage Story 42420 # Vintage Story
# 25565 # Minecraft 25565 # Minecraft
25 # Mailserver 25 # Mailserver
143 # Mailserver 143 # Mailserver
465 # Mailserver 465 # Mailserver
@ -17,21 +17,20 @@
]; ];
allowedUDPPorts = [ allowedUDPPorts = [
10000 # Jitsi Meet (udp) 10000 # Jitsi Meet (udp)
# 15636 # Enshrouded - Game 15636 # Enshrouded - Game
# 15637 # Enshrouded - Query Port 15637 # Enshrouded - Query Port
]; ];
}; };
nftables = { nftables = {
enable = true; enable = true;
# NOTE: If these need to be re-enabled, move them to the PREROUTING chain below
# iifname "enp0s4" udp dport 15636 dnat to 10.100.1.2:15636;
# iifname "enp0s4" udp dport 15637 dnat to 10.100.1.2:15637;
ruleset = '' ruleset = ''
table ip nat { table ip nat {
chain PREROUTING { chain PREROUTING {
type nat hook prerouting priority dstnat; policy accept; type nat hook prerouting priority dstnat; policy accept;
iifname "enp0s4" udp dport 10000 dnat to 10.100.0.2:10000; iifname "enp0s4" udp dport 10000 dnat to 10.100.0.2:10000;
iifname "enp0s4" udp dport 15636 dnat to 10.100.1.2:15636;
iifname "enp0s4" udp dport 15637 dnat to 10.100.1.2:15637;
} }
} }
''; '';
@ -43,8 +42,8 @@
externalInterface = "wireguard0"; externalInterface = "wireguard0";
forwardPorts = [ forwardPorts = [
{ sourcePort = 10000; proto = "udp"; destination = "10.100.0.2:10000"; } { sourcePort = 10000; proto = "udp"; destination = "10.100.0.2:10000"; }
# { sourcePort = 15636; proto = "udp"; destination = "10.100.1.2:15636"; } { sourcePort = 15636; proto = "udp"; destination = "10.100.1.2:15636"; }
# { sourcePort = 15637; proto = "udp"; destination = "10.100.1.2:15637"; } { sourcePort = 15637; proto = "udp"; destination = "10.100.1.2:15637"; }
]; ];
}; };
}; };
@ -64,7 +63,6 @@
frontend http frontend http
mode http mode http
bind :80 bind :80
# bind :::80 v4v6
# bind :443 ssl crt /Storage/Data/Docker/sysctl.io/letsencrypt/external/*.sysctl.io/combined.pem # bind :443 ssl crt /Storage/Data/Docker/sysctl.io/letsencrypt/external/*.sysctl.io/combined.pem
acl is-blocked-ip src -f /etc/haproxy-blocked-ips acl is-blocked-ip src -f /etc/haproxy-blocked-ips
@ -84,10 +82,7 @@
bind :25565 bind :25565
bind :4443 bind :4443
bind :443 bind :443
# bind :::25565 v4v6
# bind :::4443 v4v6
# bind :::443 v4v6
acl is-blocked-ip src -f /etc/haproxy-blocked-ips acl is-blocked-ip src -f /etc/haproxy-blocked-ips
http-request deny if is-blocked-ip http-request deny if is-blocked-ip
@ -104,7 +99,7 @@
bind :587 bind :587
bind :993 bind :993
bind :4190 bind :4190
default_backend backend_mail
backend backend_mail backend backend_mail
mode tcp mode tcp
server mailserver-wg 10.100.1.3 server mailserver-wg 10.100.1.3
@ -112,7 +107,6 @@
frontend vintage-story frontend vintage-story
mode tcp mode tcp
bind :42420 bind :42420
# bind :::42420 v4v6
default_backend backend_vintage-story default_backend backend_vintage-story
backend backend_vintage-story backend backend_vintage-story
mode tcp mode tcp
@ -378,3 +372,4 @@
66.249.79.96/27 66.249.79.96/27
''; '';
} }