Compare commits

..

1 Commits

2 changed files with 10 additions and 15 deletions

View File

@ -85,10 +85,8 @@ in
family = "inet";
content = ''
${nftIdentifiers}
define ALLOWED_TCP_PORTS = { ssh }
define ALLOWED_UDP_PORTS = { 18596 }
define ALLOWED_TCP_LAN_PORTS = { ssh, https }
define ALLOWED_UDP_LAN_PORTS = { bootps, dhcpv6-server, domain, https }
define ALLOWED_TCP_PORTS = { ssh, https }
define ALLOWED_UDP_PORTS = { bootps, dhcpv6-server, domain, https }
set port_forward_v6 {
type inet_proto . ipv6_addr . inet_service
elements = {
@ -135,10 +133,6 @@ in
# but apparently not.
ip6 daddr { fe80::/10, ff02::/16 } th dport { dhcpv6-client, dhcpv6-server } accept
# Global input rules
tcp dport $ALLOWED_TCP_PORTS accept
udp dport $ALLOWED_UDP_PORTS accept
# WAN zone input rules
iifname $ZONE_WAN_IFS jump zone_wan_input
# LAN zone input rules
@ -163,7 +157,8 @@ in
}
chain zone_wan_input {
# Allow specific stuff from WAN
# Allow SSH from WAN (if needed)
tcp dport ssh accept
}
chain zone_wan_forward {
@ -185,8 +180,8 @@ in
ip protocol icmp accept
# Allow specific services from LAN
tcp dport $ALLOWED_TCP_LAN_PORTS accept
udp dport $ALLOWED_UDP_LAN_PORTS accept
tcp dport $ALLOWED_TCP_PORTS accept
udp dport $ALLOWED_UDP_PORTS accept
}
chain zone_lan_forward {

View File

@ -24,7 +24,7 @@ let
];
in
{
secrix.services.systemd-networkd.secrets = let
secrix.system.secrets = let
pskEnabledPeers = builtins.filter (peer: peer.pskEnabled) wg0Peers;
peerToSecretAttrs = peer: {
name = "wg0-peer-${peer.name}-psk";
@ -44,13 +44,13 @@ in
Name = "wg0";
};
wireguardConfig = {
PrivateKeyFile = config.secrix.services.systemd-networkd.secrets.wg0-private-key.decrypted.path;
PrivateKeyFile = config.secrix.system.secrets.wg0-private-key.decrypted.path;
ListenPort = 18596;
};
wireguardPeers = map (peer: {
AllowedIPs = lib.strings.concatStringsSep "," peer.allowedIPs;
AllowedIPs = peer.allowedIPs;
PublicKey = peer.publicKey;
PresharedKeyFile = if peer.pskEnabled then config.secrix.services.systemd-networkd.secrets."wg0-peer-${peer.name}-psk".decrypted.path else null;
PresharedKeyFile = if peer.pskEnabled then config.secrix.system.secrets."wg0-peer-${peer.name}-psk".decrypted.path else null;
}) wg0Peers;
};
};