SK-Development-Studios/Nixos-Configuration
2
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

firewall improved to use module tables feature

Browse source
This commit is contained in:
Jermeiah S 2025-07-01 17:32:55 -04:00
parent 69e69c2b7f
commit 9fc3927c86
No known key found for this signature in database
1 changed files with 26 additions and 22 deletions
Download patch file Download diff file Expand all files Collapse all files

48
modules/nixos/common/firewall.nix
View file

@ -1,33 +1,37 @@
{ {
lib, # lib,
pkgs, # pkgs,
config, # config,
... ...
}: }:
{ {
networking.nftables = { networking.nftables = {
enable = true; enable = true;
ruleset = '' tables = {
table inet filter { yggSsh = {
chain input { name = "yggSsh";
type filter hook input priority filter; policy accept; family = "inet";
ct state related,established accept content = ''
chain input {
type filter hook input priority filter; policy accept;
ct state related,established accept
# Restrict ygg0: only allow SSH in # Restrict ygg0: only allow SSH in
iifname "ygg0" tcp dport 22 accept iifname "ygg0" tcp dport 22 accept
iifname "ygg0" drop iifname "ygg0" drop
} }
chain forward { chain forward {
type filter hook forward priority filter; policy accept; type filter hook forward priority filter; policy accept;
# Optional: drop forwarding via ygg0 # Optional: drop forwarding via ygg0
iifname "ygg0" drop iifname "ygg0" drop
} }
chain output { chain output {
type filter hook output priority filter; policy accept; type filter hook output priority filter; policy accept;
} }
} '';
''; };
};
}; };
} }