CaZzzer/nix-conf
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

WIP: router: firewall: proper filtering for hosts proxied by cloudflare

Browse Source
This commit is contained in:
Yuri Tatishchev 2025-03-25 22:50:11 -07:00
parent 8290063bca
commit 809a6f36dc
Signed by: CaZzzer
GPG Key ID: E0EBF441EA424369
1 changed files with 19 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
hosts/router/firewall.nix
View File

@ -26,6 +26,17 @@ in
$OPNSENSE_NET6, $OPNSENSE_NET6,
} }
define RFC1918 = { 10.0.0.0/8, 172.12.0.0/12, 192.168.0.0/16 } define RFC1918 = { 10.0.0.0/8, 172.12.0.0/12, 192.168.0.0/16 }
define CLOUDFLARE_NET6 = {
# https://www.cloudflare.com/ips-v6
# TODO: figure out a better way to get addrs dynamically from url
2400:cb00::/32,
2606:4700::/32,
2803:f800::/32,
2405:b500::/32,
2405:8100::/32,
2a06:98c0::/29,
2c0f:f248::/32,
}
define ALLOWED_TCP_PORTS = { ssh, https } define ALLOWED_TCP_PORTS = { ssh, https }
define ALLOWED_UDP_PORTS = { bootps, dhcpv6-server, domain } define ALLOWED_UDP_PORTS = { bootps, dhcpv6-server, domain }
@ -38,9 +49,12 @@ in
} }
set port_forward_v6 { set port_forward_v6 {
type inet_proto . ipv6_addr . inet_service type inet_proto . ipv6_addr . inet_service
# elements = {}
}
set cloudflare_forward_v6 {
type ipv6_addr
elements = { elements = {
tcp . ${ifs.lan.p6}::11:1 . https, ${ifs.lan.p6}::11:1,
tcp . ${ifs.lan.p6}:1cd5:56ff:feec:c74a . https,
} }
} }
@ -109,6 +123,9 @@ in
# Allowed IPv6 ports # Allowed IPv6 ports
meta l4proto . ip6 daddr . th dport @port_forward_v6 accept meta l4proto . ip6 daddr . th dport @port_forward_v6 accept
# Allowed IPv6 from cloudflare
ip6 saddr $CLOUDFLARE_NET6 ip6 daddr @cloudflare_forward_v6 accept
} }
chain zone_lan_input { chain zone_lan_input {