vleeuwenmenno/dotfiles
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refactors firewall configuration to enhance security and internal communication rules

Browse Source
This commit is contained in:
Menno van Leeuwen
2024-11-16 02:53:12 +01:00
parent 9b1ceddeb7
commit a068565066
1 changed files with 70 additions and 63 deletions
Download Patch File Download Diff File Expand all files Collapse all files

133
config/nixos/common/server.nix
View File

@ -1,6 +1,5 @@
{ config, pkgs, ... }: { config, pkgs, ... }:
{ {
# OpenSSH server
services.openssh = { services.openssh = {
enable = true; enable = true;
ports = [ 400 ]; ports = [ 400 ];
@ -16,74 +15,82 @@
}; };
}; };
# Open ports in the firewall networking = {
networking.firewall = { nat.enable = true;
enable = true; nat.enableIPv6 = true;
# Ports accessible from anywhere firewall = {
allowedTCPPorts = [ enable = true;
80 # HTTP
443 # HTTPS
22 # Git over SSH
400 # SSH
25565 # Minecraft
3456 # Minecraft (Bluemap)
32400 # Plex
8096 # Jellyfin
];
allowedUDPPorts = [
51820 # WireGuard
];
# Common internal ports for docker0, tailscale0, and LAN # Only truly external ports
interfaces = allowedTCPPorts = [
let 80 # HTTP
internalPorts = [ 443 # HTTPS
81 # Nginx Proxy Manager 22 # Git over SSH
5334 # Duplicati Notifications 400 # SSH
7788 # Sabnzbd 25565 # Minecraft
8085 # Qbittorrent 3456 # Minecraft (Bluemap)
3030 # Gitea 32400 # Plex
5080 # Factorio Server Manager 8096 # Jellyfin
5555 # Overseerr ];
9696 # Prowlarr
7878 # Radarr
8686 # Lidarr
8989 # Sonarr
8386 # Whisparr
8191 # Flaresolerr
9999 # Stash
];
in
{
"docker0".allowedTCPPorts = internalPorts;
"tailscale0".allowedTCPPorts = internalPorts;
"enp39s0".allowedTCPPorts = internalPorts;
};
extraCommands = '' allowedUDPPorts = [
# Allow established connections 51820 # WireGuard
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT ];
# Allow internal network traffic # Internal ports
iptables -A INPUT -i docker0 -j ACCEPT interfaces =
iptables -A INPUT -i tailscale0 -j ACCEPT let
iptables -A INPUT -s 192.168.0.0/16 -j ACCEPT internalPorts = [
81 # Nginx Proxy Manager
5334 # Duplicati Notifications
7788 # Sabnzbd
8085 # Qbittorrent
3030 # Gitea
5080 # Factorio Server Manager
5555 # Overseerr
9696 # Prowlarr
7878 # Radarr
8686 # Lidarr
8989 # Sonarr
8386 # Whisparr
8191 # Flaresolerr
9999 # Stash
];
in
{
"docker0".allowedTCPPorts = internalPorts;
"tailscale0".allowedTCPPorts = internalPorts;
"enp39s0".allowedTCPPorts = internalPorts;
};
# Allow all Docker-related traffic extraCommands = ''
iptables -A INPUT -s 172.16.0.0/12 -j ACCEPT # Covers all Docker network ranges # Allow established connections
iptables -A FORWARD -s 172.16.0.0/12 -j ACCEPT iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -d 172.16.0.0/12 -j ACCEPT
# Allow Docker container communication # Block WAN access to internal services
iptables -A DOCKER-USER -i docker0 -o docker0 -j ACCEPT iptables -I INPUT -i enp39s0 ! -s 192.168.0.0/16 -j DROP
# Allow traffic between different Docker networks # Allow internal network traffic
iptables -A FORWARD -i br-* -o br-* -j ACCEPT iptables -A INPUT -i docker0 -j ACCEPT
iptables -A FORWARD -i docker0 -o br-* -j ACCEPT iptables -A INPUT -i tailscale0 -j ACCEPT
iptables -A FORWARD -i br-* -o docker0 -j ACCEPT iptables -A INPUT -s 192.168.0.0/16 -j ACCEPT
'';
# Required for Tailscale # Allow Docker inter-network communication
checkReversePath = "loose"; iptables -A FORWARD -i br-* -o br-* -j ACCEPT
iptables -A FORWARD -i docker0 -o br-* -j ACCEPT
iptables -A FORWARD -i br-* -o docker0 -j ACCEPT
# Allow Docker subnet traffic but only internally
iptables -A INPUT -s 172.16.0.0/12 -i docker0 -j ACCEPT
iptables -A INPUT -s 172.16.0.0/12 -i br-+ -j ACCEPT
# Allow Docker container communication
iptables -A DOCKER-USER -i docker0 -o docker0 -j ACCEPT
'';
# Required for Tailscale
checkReversePath = "loose";
};
}; };
} }