summaryrefslogtreecommitdiffstats
path: root/modules/tv/iptables/config.nix
diff options
context:
space:
mode:
authortv <tv@shackspace.de>2015-06-22 15:24:09 +0200
committertv <tv@shackspace.de>2015-06-22 15:24:09 +0200
commit53305dc496f7f15504a8ef2f1f9511fb0b2f78ab (patch)
tree273daca78a42d1f8d8ef4bd5ef6ea33598bfc618 /modules/tv/iptables/config.nix
parent1538630782ac8c56d549af4fcac4c9abcba8c9c5 (diff)
tv: modularize iptables configuration
Diffstat (limited to 'modules/tv/iptables/config.nix')
-rw-r--r--modules/tv/iptables/config.nix93
1 files changed, 93 insertions, 0 deletions
diff --git a/modules/tv/iptables/config.nix b/modules/tv/iptables/config.nix
new file mode 100644
index 000000000..a525cfa5d
--- /dev/null
+++ b/modules/tv/iptables/config.nix
@@ -0,0 +1,93 @@
+{ cfg, lib, pkgs, ... }:
+
+let
+ inherit (pkgs) writeScript writeText;
+ inherit (lib) concatMapStringsSep;
+
+ accept-new-tcp = port:
+ "-p tcp -m tcp --dport ${port} -m conntrack --ctstate NEW -j ACCEPT";
+
+ rules = iptables-version:
+ writeText "tv-iptables-rules${toString iptables-version}" ''
+ *nat
+ :PREROUTING ACCEPT [0:0]
+ :INPUT ACCEPT [0:0]
+ :OUTPUT ACCEPT [0:0]
+ :POSTROUTING ACCEPT [0:0]
+ ${concatMapStringsSep "\n" (rule: "-A PREROUTING ${rule}") ([]
+ ++ [
+ "! -i retiolum -p tcp -m tcp --dport 22 -j REDIRECT --to-ports 0"
+ "-p tcp -m tcp --dport 11423 -j REDIRECT --to-ports 22"
+ ]
+ )}
+ COMMIT
+ *filter
+ :INPUT DROP [0:0]
+ :FORWARD DROP [0:0]
+ :OUTPUT ACCEPT [0:0]
+ :Retiolum - [0:0]
+ ${concatMapStringsSep "\n" (rule: "-A INPUT ${rule}") ([]
+ ++ [
+ "-m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT"
+ "-i lo -j ACCEPT"
+ ]
+ ++ map accept-new-tcp cfg.input-internet-accept-new-tcp
+ ++ ["-i retiolum -j Retiolum"]
+ )}
+ ${concatMapStringsSep "\n" (rule: "-A Retiolum ${rule}") ([]
+ ++ {
+ ip4tables = [
+ "-p icmp -m icmp --icmp-type echo-request -j ACCEPT"
+ ];
+ ip6tables = [
+ "-p ipv6-icmp -m icmp6 --icmpv6-type echo-request -j ACCEPT"
+ ];
+ }."ip${toString iptables-version}tables"
+ ++ map accept-new-tcp cfg.input-retiolum-accept-new-tcp
+ ++ {
+ ip4tables = [
+ "-p tcp -j REJECT --reject-with tcp-reset"
+ "-p udp -j REJECT --reject-with icmp-port-unreachable"
+ "-j REJECT --reject-with icmp-proto-unreachable"
+ ];
+ ip6tables = [
+ "-p tcp -j REJECT --reject-with tcp-reset"
+ "-p udp -j REJECT --reject-with icmp6-port-unreachable"
+ "-j REJECT"
+ ];
+ }."ip${toString iptables-version}tables"
+ )}
+ COMMIT
+ '';
+
+ startScript = writeScript "tv-iptables_start" ''
+ #! /bin/sh
+ set -euf
+ iptables-restore < ${rules 4}
+ ip6tables-restore < ${rules 6}
+ '';
+in
+
+{
+ networking.firewall.enable = false;
+
+ systemd.services.tv-iptables = {
+ description = "tv-iptables";
+ wantedBy = [ "network-pre.target" ];
+ before = [ "network-pre.target" ];
+ after = [ "systemd-modules-load.service" ];
+
+ path = with pkgs; [
+ iptables
+ ];
+
+ restartIfChanged = true;
+
+ serviceConfig = {
+ Type = "simple";
+ RemainAfterExit = true;
+ Restart = "always";
+ ExecStart = "@${startScript} tv-iptables_start";
+ };
+ };
+}