commit 4fa0fb1dfd595320678400bc7947af41fd369b84
parent 8fade9a31179f190ce2ab2f91ab934ee6a6668df
Author: Vineet Kumar <git@vineetk.net>
Date: Sat, 31 Jan 2026 20:11:15 -0500
saklas: add firewall
Diffstat:
1 file changed, 110 insertions(+), 3 deletions(-)
diff --git a/epistemia/systems/saklas.scm b/epistemia/systems/saklas.scm
@@ -41,10 +41,115 @@ if ($bad_boi = 1) {
}
"))
+;; adapted from my pf.conf
+(define %nftables-ruleset
+ (plain-file "nftables.conf" "\
+define ext_if = \"eth0\"
+define vpn_if = \"wg0\"
+
+define tcp_ports = {
+ http, https,
+ smtp, smtps, imaps,
+ xmpp-client, xmpp-server, 5281, 5201,
+ 6060
+}
+
+define udp_ports = {
+ 3478, 5201, 51820
+}
+
+table inet filter {
+ set ssh_whitelist_ipv4 {
+ type ipv4_addr
+ flags interval
+ elements = {
+ 23.128.112.0/24,
+ 45.134.142.0/24,
+ 47.201.69.0/24,
+ 47.205.89.0/24,
+ 79.127.222.0/24,
+ 91.90.40.0/24,
+ 146.70.187.0/24,
+ 176.125.235.0/24,
+ 178.255.149.0/24,
+ 194.127.199.0/24
+ }
+ }
+
+ set ssh_whitelist_ipv6 {
+ type ipv6_addr
+ flags interval
+ elements = {
+ 2a02:20c8:4124::a01e,
+ 2a02:20c8:4124::a02e,
+ 2a02:20c8:4124::a03e,
+ 2a02:20c8:4124::a03e,
+ 2a02:20c8:4124::a04e,
+ 2a02:20c8:4124::e401,
+ 2a02:20c8:4124::e501,
+ 2a02:20c8:4124::e71c,
+ 2a02:20c8:4124::e81c,
+ 2a02:20c8:4120::a01e,
+ 2a02:6ea0:cc1f::e01c,
+ 2a02:6ea0:cc1f:1::e01c,
+ 2a02:6ea0:cc1f:2::e01c,
+ 2a02:6ea0:fe00:2::e021,
+ 2a0d:5600:6:104::e01c,
+ 2a0d:5600:6:105::e01c,
+ 2a0d:5600:6:106::e01c
+ }
+ }
+
+ chain input {
+ type filter hook input priority 0; policy drop;
+
+ # set skip on lo
+ iifname lo accept
+ # drop connections to lo not coming from lo
+ iif != lo ip daddr 127.0.0.1/8 drop
+ iif != lo ip6 daddr ::1/128 drop
+
+ # early drop of invalid connections
+ ct state invalid drop
+ # allow established/related connections
+ ct state { established, related } accept
+
+ # unblock pings
+ ip protocol icmp icmp type echo-request accept
+ ip6 nexthdr icmpv6 icmpv6 type { packet-too-big, echo-request } accept
+ ip6 nexthdr icmpv6 icmpv6 \
+ type { echo-request, nd-router-solicit, nd-router-advert,
+ nd-neighbor-solicit, nd-neighbor-advert, nd-redirect } accept
+
+ iifname $ext_if tcp dport $tcp_ports ct state new accept
+ iifname $ext_if udp dport $udp_ports ct state new accept
+
+ iifname $vpn_if tcp dport { 9090, 9100 } ct state new accept
+
+ # allow public ssh only to my normal home address and mullvad ips
+ iifname $ext_if tcp dport ssh ip saddr @ssh_whitelist_ipv4 ct state new log prefix \"SSH_V4: \" accept
+ iifname $ext_if tcp dport ssh ip6 saddr @ssh_whitelist_ipv6 ct state new log prefix \"SSH_V6: \" accept
+
+ iifname wg1 accept
+
+ # reject everything else
+ log prefix \"BLOCK: \" reject with icmpx type port-unreachable
+ }
+
+ chain forward {
+ type filter hook forward priority 0; policy drop;
+ }
+
+ chain output {
+ type filter hook output priority 0; policy accept;
+ }
+}
+"))
+
+
(operating-system
(inherit base-system)
- ;; (host-name "saklas")
- (host-name "162.55.242.220")
+ (host-name "saklas.epistemia")
(users (cons (user-account
(name "vin")
@@ -113,7 +218,9 @@ if ($bad_boi = 1) {
(simple-service 'zfs-shepherd-services-user-processes
user-processes-service-type
'(zfs-automount))
- (service iptables-service-type)
+ (service nftables-service-type
+ (nftables-configuration
+ (ruleset %nftables-ruleset)))
(service static-networking-service-type
(list (static-networking
(addresses
