From 8124337c5182b02e3057ebde1213050d4a714a0f Mon Sep 17 00:00:00 2001
From: Gregor Kleen <gkleen@yggdrasil.li>
Date: Wed, 8 Dec 2021 17:59:52 +0100
Subject: vidhar: nftables...

---
 hosts/vidhar/default.nix | 50 +++---------------------------------------------
 1 file changed, 3 insertions(+), 47 deletions(-)

(limited to 'hosts/vidhar/default.nix')

diff --git a/hosts/vidhar/default.nix b/hosts/vidhar/default.nix
index 622c2c54..e05b9416 100644
--- a/hosts/vidhar/default.nix
+++ b/hosts/vidhar/default.nix
@@ -78,54 +78,10 @@
         ];
       };
 
-      firewall = {
+      firewall.enable = false;
+      nftables = {
         enable = true;
-        package = pkgs.iptables-nftables-compat;
-        allowPing = true;
-        allowedTCPPorts = [
-          22 # ssh
-        ];
-        allowedUDPPorts = [
-          51820 # wireguard
-        ];
-        allowedUDPPortRanges = [
-          { from = 60000; to = 61000; } # mosh
-        ];
-        extraCommands = ''
-          ip46tables -D FORWARD -j nixos-fw-forward 2>/dev/null || true
-          ip46tables -F nixos-fw-forward 2>/dev/null || true
-          ip46tables -X nixos-fw-forward 2>/dev/null || true
-          ip46tables -N nixos-fw-forward
-
-          ip46tables -A nixos-fw-forward -i eno1 -j ACCEPT
-          ip46tables -A nixos-fw-forward -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
-          ip6tables -A nixos-fw-forward -p icmpv6 --icmpv6-type redirect -j nixos-fw-log-refuse
-          ip6tables -A nixos-fw-forward -p icmpv6 --icmpv6-type 139 -j nixos-fw-log-refuse
-          ip6tables -A nixos-fw-forward -p icmpv6 -j ACCEPT
-
-          ip46tables -A nixos-fw-forward -j nixos-fw-log-refuse
-          ip46tables -A FORWARD -j nixos-fw-forward
-
-
-          ip46tables -t nat -D POSTROUTING -j nixos-fw-postrouting 2>/dev/null || true
-          ip46tables -t nat -F nixos-fw-postrouting 2>/dev/null || true
-          ip46tables -t nat -X nixos-fw-postrouting 2>/dev/null || true
-          ip46tables -t nat -N nixos-fw-postrouting
-
-          iptables -t nat -A nixos-fw-postrouting -o dsl -j MASQUERADE
-
-          ip46tables -t nat -A POSTROUTING -j nixos-fw-postrouting
-
-
-          ip46tables -t mangle -D POSTROUTING -j nixos-fw-postrouting 2>/dev/null || true
-          ip46tables -t mangle -F nixos-fw-postrouting 2>/dev/null || true
-          ip46tables -t mangle -X nixos-fw-postrouting 2>/dev/null || true
-
-          ip46tables -t mangle -N nixos-fw-postrouting
-          ip46tables -t mangle -A nixos-fw-postrouting -o dsl -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
-
-          ip46tables -t mangle -A POSTROUTING -j nixos-fw-postrouting
-        '';
+        rulesetFile = ./ruleset.nft;
       };
     };
 
-- 
cgit v1.2.3