drop nixos firewall, use nftables directly

1 files changed, 47 insertions, 0 deletions

diff --git a/hosts/nyaan/network.nix b/hosts/nyaan/network.nix
index ac08cb4..14cbfe2 100644
--- a/hosts/nyaan/network.nix
+++ b/hosts/nyaan/network.nix
@@ -18,6 +18,53 @@ in
   networking = {
     hostName = "nyaan";
     useNetworkd = true;
+    firewall.enable = false;
+    nftables = {
+      enable = true;
+      tables.filter = {
+        enable = true;
+        family = "inet";
+        content = ''
+          	set temp-ports {
+              type inet_proto . inet_service
+              flags interval
+              comment "Temporarily opened ports"
+            }
+
+          	chain rpfilter {
+              type filter hook prerouting priority mangle + 10; policy drop;
+              meta nfproto ipv4 udp sport . udp dport { 68 . 67, 67 . 68 } accept comment "DHCPv4 client/server"
+              fib saddr . mark . iif check exists accept
+              jump rpfilter-allow
+            }
+
+            chain rpfilter-allow {
+            }
+
+            chain prerouting {
+              type filter hook prerouting priority mangle;
+              iifname "wg0" meta mark set 42
+            }
+
+            chain input {
+              type filter hook input priority filter; policy drop;
+              iifname "lo" accept comment "trusted interfaces"
+              icmpv6 type echo-reply accept
+              ct state vmap { invalid : drop, established : accept, related : accept, new : jump input-allow, untracked : jump input-allow }
+            }
+
+            chain input-allow {
+              # tcp dport { 22, 80, 443 } accept
+              udp dport 51820 accept
+              udp dport 5353 meta mark 42 accept comment "mDNS over wireguard"
+              meta l4proto . th dport @temp-ports accept
+              icmp type echo-request accept comment "allow ping"
+              icmpv6 type != { nd-redirect, 139 } accept comment "Accept all ICMPv6 messages except redirects and node information queries (type 139).  See RFC 4890, section 4.4."
+              ip6 daddr fe80::/64 udp dport 546 accept comment "DHCPv6 client"
+            }
+        '';
+      };
+    };
     wireless = {
       enable = true;
       secretsFile = secrets."wireless.env".path;