pyrox.dev
1{ config, lib, pkgs, ... }:
2
3with lib;
4
5let
6
7 cfg = config.networking.firewall;
8
9 ifaceSet = concatStringsSep ", " (
10 map (x: ''"${x}"'') cfg.trustedInterfaces
11 );
12
13 portsToNftSet = ports: portRanges: concatStringsSep ", " (
14 map (x: toString x) ports
15 ++ map (x: "${toString x.from}-${toString x.to}") portRanges
16 );
17
18in
19
20{
21
22 options = {
23
24 networking.firewall = {
25 extraInputRules = mkOption {
26 type = types.lines;
27 default = "";
28 example = "ip6 saddr { fc00::/7, fe80::/10 } tcp dport 24800 accept";
29 description = ''
30 Additional nftables rules to be appended to the input-allow
31 chain.
32
33 This option only works with the nftables based firewall.
34 '';
35 };
36
37 extraForwardRules = mkOption {
38 type = types.lines;
39 default = "";
40 example = "iifname wg0 accept";
41 description = ''
42 Additional nftables rules to be appended to the forward-allow
43 chain.
44
45 This option only works with the nftables based firewall.
46 '';
47 };
48
49 extraReversePathFilterRules = mkOption {
50 type = types.lines;
51 default = "";
52 example = "fib daddr . mark . iif type local accept";
53 description = ''
54 Additional nftables rules to be appended to the rpfilter-allow
55 chain.
56
57 This option only works with the nftables based firewall.
58 '';
59 };
60 };
61
62 };
63
64 config = mkIf (cfg.enable && config.networking.nftables.enable) {
65
66 assertions = [
67 {
68 assertion = cfg.extraCommands == "";
69 message = "extraCommands is incompatible with the nftables based firewall: ${cfg.extraCommands}";
70 }
71 {
72 assertion = cfg.extraStopCommands == "";
73 message = "extraStopCommands is incompatible with the nftables based firewall: ${cfg.extraStopCommands}";
74 }
75 {
76 assertion = cfg.pingLimit == null || !(hasPrefix "--" cfg.pingLimit);
77 message = "nftables syntax like \"2/second\" should be used in networking.firewall.pingLimit";
78 }
79 {
80 assertion = config.networking.nftables.rulesetFile == null;
81 message = "networking.nftables.rulesetFile conflicts with the firewall";
82 }
83 ];
84
85 networking.nftables.tables."nixos-fw".family = "inet";
86 networking.nftables.tables."nixos-fw".content = ''
87 ${optionalString (cfg.checkReversePath != false) ''
88 chain rpfilter {
89 type filter hook prerouting priority mangle + 10; policy drop;
90
91 meta nfproto ipv4 udp sport . udp dport { 67 . 68, 68 . 67 } accept comment "DHCPv4 client/server"
92 fib saddr . mark ${optionalString (cfg.checkReversePath != "loose") ". iif"} oif exists accept
93
94 jump rpfilter-allow
95
96 ${optionalString cfg.logReversePathDrops ''
97 log level info prefix "rpfilter drop: "
98 ''}
99
100 }
101 ''}
102
103 chain rpfilter-allow {
104 ${cfg.extraReversePathFilterRules}
105 }
106
107 chain input {
108 type filter hook input priority filter; policy drop;
109
110 ${optionalString (ifaceSet != "") ''iifname { ${ifaceSet} } accept comment "trusted interfaces"''}
111
112 # Some ICMPv6 types like NDP is untracked
113 ct state vmap {
114 invalid : drop,
115 established : accept,
116 related : accept,
117 new : jump input-allow,
118 untracked: jump input-allow,
119 }
120
121 ${optionalString cfg.logRefusedConnections ''
122 tcp flags syn / fin,syn,rst,ack log level info prefix "refused connection: "
123 ''}
124 ${optionalString (cfg.logRefusedPackets && !cfg.logRefusedUnicastsOnly) ''
125 pkttype broadcast log level info prefix "refused broadcast: "
126 pkttype multicast log level info prefix "refused multicast: "
127 ''}
128 ${optionalString cfg.logRefusedPackets ''
129 pkttype host log level info prefix "refused packet: "
130 ''}
131
132 ${optionalString cfg.rejectPackets ''
133 meta l4proto tcp reject with tcp reset
134 reject
135 ''}
136
137 }
138
139 chain input-allow {
140
141 ${concatStrings (mapAttrsToList (iface: cfg:
142 let
143 ifaceExpr = optionalString (iface != "default") "iifname ${iface}";
144 tcpSet = portsToNftSet cfg.allowedTCPPorts cfg.allowedTCPPortRanges;
145 udpSet = portsToNftSet cfg.allowedUDPPorts cfg.allowedUDPPortRanges;
146 in
147 ''
148 ${optionalString (tcpSet != "") "${ifaceExpr} tcp dport { ${tcpSet} } accept"}
149 ${optionalString (udpSet != "") "${ifaceExpr} udp dport { ${udpSet} } accept"}
150 ''
151 ) cfg.allInterfaces)}
152
153 ${optionalString cfg.allowPing ''
154 icmp type echo-request ${optionalString (cfg.pingLimit != null) "limit rate ${cfg.pingLimit}"} accept comment "allow ping"
155 ''}
156
157 icmpv6 type != { nd-redirect, 139 } accept comment "Accept all ICMPv6 messages except redirects and node information queries (type 139). See RFC 4890, section 4.4."
158 ip6 daddr fe80::/64 udp dport 546 accept comment "DHCPv6 client"
159
160 ${cfg.extraInputRules}
161
162 }
163
164 ${optionalString cfg.filterForward ''
165 chain forward {
166 type filter hook forward priority filter; policy drop;
167
168 ct state vmap {
169 invalid : drop,
170 established : accept,
171 related : accept,
172 new : jump forward-allow,
173 untracked : jump forward-allow,
174 }
175
176 }
177
178 chain forward-allow {
179
180 icmpv6 type != { router-renumbering, 139 } accept comment "Accept all ICMPv6 messages except renumbering and node information queries (type 139). See RFC 4890, section 4.3."
181
182 ct status dnat accept comment "allow port forward"
183
184 ${cfg.extraForwardRules}
185
186 }
187 ''}
188 '';
189
190 };
191
192}