sif: network for libvirtd

1 files changed, 50 insertions, 0 deletions

diff --git a/hosts/sif/ruleset.nft b/hosts/sif/ruleset.nft
index 363ffbdc..2a1467b8 100644
--- a/hosts/sif/ruleset.nft
+++ b/hosts/sif/ruleset.nft
@@ -84,6 +84,10 @@ table inet filter {
 
   counter tx {}
 
+  counter fw-libvirt {}
+  counter libvirt-dhcp {}
+  counter libvirt-dns {}
+
 
   chain forward {
     type filter hook forward priority filter
@@ -95,6 +99,9 @@ table inet filter {
 
     iifname lo counter name fw-lo accept
 
+    iifname virbr0 oifname != {lo, wgrz, yggdrasil-wg-4, yggdrasil-wg-6, yggdrasil, ip6tnl, ip6gre, yggre-surtr-6, yggre-surtr-4, yggre-vidhar-4} counter name fw-libvirt accept
+    oifname virbr0 ct state {established, related} counter name fw-libvirt accept
+
 
     limit name lim_reject log level debug prefix "drop forward: " counter name reject-ratelimit-fw drop
     log level debug prefix "reject forward: " counter name reject-fw
@@ -125,6 +132,11 @@ table inet filter {
     udp dport 51820-51822 counter name wg-rx accept
     iifname "yggdrasil-wg-*" meta l4proto gre counter name yggdrasil-gre-rx accept
 
+    iifname virbr0 udp dport 67 counter name libvirt-dhcp accept
+    iifname virbr0 udp dport 547 counter name libvirt-dhcp accept
+    iifname virbr0 udp dport 53 counter name libvirt-dns accept
+    iifname virbr0 tcp dport 53 counter name libvirt-dns accept
+
     ct state {established, related} counter name established-rx accept
 
 
@@ -153,7 +165,45 @@ table inet filter {
 
     tcp sport 8000 counter name quickserve-tx accept
 
+    oifname virbr0 udp sport 67 counter name libvirt-dhcp accept
+    oifname virbr0 udp sport 547 counter name libvirt-dhcp accept
+    oifname virbr0 udp sport 53 counter name libvirt-dns accept
+    oifname virbr0 tcp sport 53 counter name libvirt-dns accept
+
 
     counter name tx
   }
 }
+
+table ip nat {
+  counter libvirt-nat {}
+
+  chain postrouting {
+    type nat hook postrouting priority srcnat
+    policy accept
+
+    iifname virbr0 oifname != virbr0 counter name libvirt-nat masquerade
+  }
+}
+
+table ip6 nat {
+  counter libvirt-nat {}
+
+  chain postrouting {
+    type nat hook postrouting priority srcnat
+    policy accept
+
+    iifname virbr0 oifname != virbr0 counter name libvirt-nat masquerade
+  }
+}
+
+table ip mss_clamp {
+  counter libvirt-mss-clamp {}
+
+  chain postrouting {
+    type filter hook postrouting priority mangle
+    policy accept
+
+    iifname virbr0 oifname != virbr0 tcp flags & (syn|rst) == syn counter name libvirt-mss-clamp tcp option maxseg size set rt mtu
+  }
+}
\ No newline at end of file