drop nixos firewall, use nftables directly

6 files changed, 93 insertions, 47 deletions

diff --git a/hosts/nyaan/network.nix b/hosts/nyaan/network.nix
index ac08cb4..14cbfe2 100644
--- a/hosts/nyaan/network.nix
+++ b/hosts/nyaan/network.nix
@@ -18,6 +18,53 @@ in
   networking = {
     hostName = "nyaan";
     useNetworkd = true;
+    firewall.enable = false;
+    nftables = {
+      enable = true;
+      tables.filter = {
+        enable = true;
+        family = "inet";
+        content = ''
+          	set temp-ports {
+              type inet_proto . inet_service
+              flags interval
+              comment "Temporarily opened ports"
+            }
+
+          	chain rpfilter {
+              type filter hook prerouting priority mangle + 10; policy drop;
+              meta nfproto ipv4 udp sport . udp dport { 68 . 67, 67 . 68 } accept comment "DHCPv4 client/server"
+              fib saddr . mark . iif check exists accept
+              jump rpfilter-allow
+            }
+
+            chain rpfilter-allow {
+            }
+
+            chain prerouting {
+              type filter hook prerouting priority mangle;
+              iifname "wg0" meta mark set 42
+            }
+
+            chain input {
+              type filter hook input priority filter; policy drop;
+              iifname "lo" accept comment "trusted interfaces"
+              icmpv6 type echo-reply accept
+              ct state vmap { invalid : drop, established : accept, related : accept, new : jump input-allow, untracked : jump input-allow }
+            }
+
+            chain input-allow {
+              # tcp dport { 22, 80, 443 } accept
+              udp dport 51820 accept
+              udp dport 5353 meta mark 42 accept comment "mDNS over wireguard"
+              meta l4proto . th dport @temp-ports accept
+              icmp type echo-request accept comment "allow ping"
+              icmpv6 type != { nd-redirect, 139 } accept comment "Accept all ICMPv6 messages except redirects and node information queries (type 139).  See RFC 4890, section 4.4."
+              ip6 daddr fe80::/64 udp dport 546 accept comment "DHCPv6 client"
+            }
+        '';
+      };
+    };
     wireless = {
       enable = true;
       secretsFile = secrets."wireless.env".path;
diff --git a/hosts/sagittarius/network.nix b/hosts/sagittarius/network.nix
index 7dac324..ef5f66e 100644
--- a/hosts/sagittarius/network.nix
+++ b/hosts/sagittarius/network.nix
@@ -5,8 +5,52 @@
   networking = {
     hostName = "sagittarius";
     useNetworkd = true;
-    firewall = {
-      allowedTCPPorts = [ 22 ];
+    firewall.enable = false;
+    nftables = {
+      enable = true;
+      tables.filter = {
+        enable = true;
+        family = "inet";
+        content = ''
+          	set temp-ports {
+              type inet_proto . inet_service
+              flags interval
+              comment "Temporarily opened ports"
+            }
+
+          	chain rpfilter {
+              type filter hook prerouting priority mangle + 10; policy drop;
+              meta nfproto ipv4 udp sport . udp dport { 68 . 67, 67 . 68 } accept comment "DHCPv4 client/server"
+              fib saddr . mark . iif check exists accept
+              jump rpfilter-allow
+            }
+
+            chain rpfilter-allow {
+            }
+
+            chain prerouting {
+              type filter hook prerouting priority mangle;
+              iifname "wg0" meta mark set 42
+            }
+
+            chain input {
+              type filter hook input priority filter; policy drop;
+              iifname "lo" accept comment "trusted interfaces"
+              icmpv6 type echo-reply accept
+              ct state vmap { invalid : drop, established : accept, related : accept, new : jump input-allow, untracked : jump input-allow }
+            }
+
+            chain input-allow {
+              tcp dport { 22, 80, 443 } accept
+              udp dport 51820 accept
+              udp dport 5353 meta mark 42 accept comment "mDNS over wireguard"
+              meta l4proto . th dport @temp-ports accept
+              icmp type echo-request accept comment "allow ping"
+              icmpv6 type != { nd-redirect, 139 } accept comment "Accept all ICMPv6 messages except redirects and node information queries (type 139).  See RFC 4890, section 4.4."
+              ip6 daddr fe80::/64 udp dport 546 accept comment "DHCPv6 client"
+            }
+        '';
+      };
     };
   };
 
diff --git a/hosts/sagittarius/web/blog.nix b/hosts/sagittarius/web/blog.nix
index d69ea20..b85b545 100644
--- a/hosts/sagittarius/web/blog.nix
+++ b/hosts/sagittarius/web/blog.nix
@@ -6,10 +6,6 @@
 }:
 {
   imports = [ ./acme.nix ];
-  networking.firewall.allowedTCPPorts = [
-    80
-    443
-  ];
 
   services.nginx = {
     enable = true;
diff --git a/hosts/sagittarius/web/static.nix b/hosts/sagittarius/web/static.nix
index 88f1fa5..4ee5317 100644
--- a/hosts/sagittarius/web/static.nix
+++ b/hosts/sagittarius/web/static.nix
@@ -1,10 +1,6 @@
 { ... }:
 {
   imports = [ ./acme.nix ];
-  networking.firewall.allowedTCPPorts = [
-    80
-    443
-  ];
 
   services.nginx = {
     enable = true;
diff --git a/share/system/client-common.nix b/share/system/client-common.nix
index 02af638..073abbf 100644
--- a/share/system/client-common.nix
+++ b/share/system/client-common.nix
@@ -62,17 +62,6 @@
     options = "--delete-older-than 7d";
   };
 
-  networking = {
-    # useNetworkd = true;
-    firewall = {
-      enable = true;
-      allowedTCPPorts = [
-        80
-        443
-        34197
-      ];
-    };
-  };
   services.mullvad-vpn.enable = true;
 
   virtualisation.podman = {
diff --git a/wireguard.nix b/wireguard.nix
index d36d8f3..df48ebf 100644
--- a/wireguard.nix
+++ b/wireguard.nix
@@ -46,32 +46,6 @@ in
     format = "binary";
   };
 
-  networking = {
-    firewall.allowedUDPPorts = [ wgPort ];
-
-    nftables = {
-      enable = true;
-      tables.wg-mdns = {
-        enable = true;
-        family = "inet";
-        content = ''
-          # chain prerouting {
-          #   type filter hook prerouting priority mangle;
-          #   iifname "wg0" meta mark set ${toString firewallMark}
-          # }
-
-          chain input {
-            type filter hook input priority filter;
-
-            # Allow mDNS only over wireguard
-            # udp dport 5353 meta mark ${toString firewallMark} accept
-            udp dport 5353 accept
-          }
-        '';
-      };
-    };
-  };
-
   services.resolved.settings.Resolve.MulticastDNS = false;
   systemd.network = {
     enable = true;