diff options
Diffstat (limited to 'modules/simple-firewall.nix')
-rw-r--r-- | modules/simple-firewall.nix | 65 |
1 files changed, 65 insertions, 0 deletions
diff --git a/modules/simple-firewall.nix b/modules/simple-firewall.nix new file mode 100644 index 0000000..eda869a --- /dev/null +++ b/modules/simple-firewall.nix @@ -0,0 +1,65 @@ +{ config, lib, pkgs, ... }: +let + cfg = config.orbekk.simple-firewall; +in +{ + options = { + orbekk.simple-firewall = { + enable = lib.mkEnableOption "Enable nftables firewall"; + + allowedUDPPorts = lib.mkOption { + type = lib.types.listOf lib.types.port; + default = []; + description = "List of TCP ports to allow"; + }; + + allowedTCPPorts = lib.mkOption { + type = lib.types.listOf lib.types.port; + default = []; + description = "List of TCP ports to allow"; + }; + }; + }; + + config = lib.mkIf cfg.enable { + networking.firewall.enable = lib.mkForce false; + + networking.nftables.enable = true; + + networking.nftables.ruleset = + let + csvPorts = ports: lib.concatStringsSep "," (map toString ports); + in '' + table inet filter { + chain allowed_ports { + ${lib.optionalString (cfg.allowedTCPPorts != []) '' + tcp dport {${csvPorts cfg.allowedTCPPorts}} counter accept + ''} + ${lib.optionalString (cfg.allowedUDPPorts != []) '' + udp dport {${csvPorts cfg.allowedUDPPorts}} counter accept + ''} + } + + chain input { + type filter hook input priority 0 + + iif lo accept + + ct state {established, related} accept + + ip protocol icmp limit rate 4/second counter accept + ip6 nexthdr ipv6-icmp limit rate 4/second counter accept + + jump allowed_ports + + counter drop + } + + chain output { + type filter hook output priority 0 + counter accept + } + } + ''; + }; +} |