Bun/nixos-config
1
0
Fork 1
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Move individual custom firewall rules to their own service files

Browse source
This commit is contained in:
Bun 2025-03-18 03:27:12 -04:00
parent 7635beefb7
commit 505298331e
7 changed files with 61 additions and 43 deletions
Download patch file Download diff file Expand all files Collapse all files

54
hosts/midas/firewall/default.nix
View file

@ -1,36 +1,28 @@
{ lib, config, ... }:
{ config, lib, ... }:
{
networking = {
firewall.extraInputRules = ''
ip saddr { 10.0.0.0/8, 10.100.0.0/24 } tcp dport 2049 accept comment "Accept NFS"
ip saddr { 10.0.0.0/8, ${config.secrets.ips.luna}, ${config.secrets.ips.corn} } tcp dport { 1935, 1945 } accept comment "Accept RTMP"
networking.nftables.tables.forwarding = {
family = "inet";
content = ''
chain PREROUTING {
type nat hook prerouting priority dstnat; policy accept;
tcp dport 2211 dnat ip to ${config.ips.pc}:22 comment "SSH to PC"
udp dport { 27005, 27015, 7777 } dnat ip to ${config.ips.pc} comment "PC Hosted Games"
tcp dport { 48010, 47989, 47984 } dnat ip to ${config.ips.pc} comment "PC Sunshine TCP"
udp dport { 47998, 47999, 48000 } dnat ip to ${config.ips.pc} comment "PC Sunshine UDP"
tcp dport { 38010, 37989, 37984 } dnat ip to ${config.ips.vm} comment "VM Sunshine TCP"
udp dport { 37998, 37999, 38000 } dnat ip to ${config.ips.vm} comment "VM Sunshine UDP"
udp dport { 7790, 7791, 7792 } dnat ip to ${config.ips.hx} comment "Deus Ex"
}
chain POSTROUTING {
type nat hook postrouting priority 100; policy accept;
oifname "enp0s31f6" masquerade
}
'';
# Nftables configuration only if server is enabled
nftables.tables.forwarding = {
family = "ip";
content = ''
chain PREROUTING {
type nat hook prerouting priority dstnat; policy accept;
tcp dport 2211 dnat to ${config.ips.pc}:22 comment "SSH to PC"
udp dport { 27005, 27015, 7777 } dnat to ${config.ips.pc} comment "PC Hosted Games"
tcp dport { 48010, 47989, 47984 } dnat to ${config.ips.pc} comment "PC Sunshine TCP"
udp dport { 47998, 47999, 48000 } dnat to ${config.ips.pc} comment "PC Sunshine UDP"
tcp dport { 38010, 37989, 37984 } dnat to ${config.ips.vm} comment "VM Sunshine TCP"
udp dport { 37998, 37999, 38000 } dnat to ${config.ips.vm} comment "VM Sunshine UDP"
udp dport { 7790, 7791, 7792 } dnat to ${config.ips.hx} comment "Deus Ex"
}
chain POSTROUTING {
type nat hook postrouting priority 100; policy accept;
oifname "enp0s31f6" masquerade
}
'';
};
};
# Enable IP forwarding for the server configuration