Compare commits
1 Commits
5c79cbf694
...
83380a6125
Author | SHA1 | Date | |
---|---|---|---|
83380a6125 |
@ -85,10 +85,8 @@ in
|
||||
family = "inet";
|
||||
content = ''
|
||||
${nftIdentifiers}
|
||||
define ALLOWED_TCP_PORTS = { ssh }
|
||||
define ALLOWED_UDP_PORTS = { 18596 }
|
||||
define ALLOWED_TCP_LAN_PORTS = { ssh, https }
|
||||
define ALLOWED_UDP_LAN_PORTS = { bootps, dhcpv6-server, domain, https }
|
||||
define ALLOWED_TCP_PORTS = { ssh, https }
|
||||
define ALLOWED_UDP_PORTS = { bootps, dhcpv6-server, domain, https }
|
||||
set port_forward_v6 {
|
||||
type inet_proto . ipv6_addr . inet_service
|
||||
elements = {
|
||||
@ -135,10 +133,6 @@ in
|
||||
# but apparently not.
|
||||
ip6 daddr { fe80::/10, ff02::/16 } th dport { dhcpv6-client, dhcpv6-server } accept
|
||||
|
||||
# Global input rules
|
||||
tcp dport $ALLOWED_TCP_PORTS accept
|
||||
udp dport $ALLOWED_UDP_PORTS accept
|
||||
|
||||
# WAN zone input rules
|
||||
iifname $ZONE_WAN_IFS jump zone_wan_input
|
||||
# LAN zone input rules
|
||||
@ -163,7 +157,8 @@ in
|
||||
}
|
||||
|
||||
chain zone_wan_input {
|
||||
# Allow specific stuff from WAN
|
||||
# Allow SSH from WAN (if needed)
|
||||
tcp dport ssh accept
|
||||
}
|
||||
|
||||
chain zone_wan_forward {
|
||||
@ -185,8 +180,8 @@ in
|
||||
ip protocol icmp accept
|
||||
|
||||
# Allow specific services from LAN
|
||||
tcp dport $ALLOWED_TCP_LAN_PORTS accept
|
||||
udp dport $ALLOWED_UDP_LAN_PORTS accept
|
||||
tcp dport $ALLOWED_TCP_PORTS accept
|
||||
udp dport $ALLOWED_UDP_PORTS accept
|
||||
}
|
||||
|
||||
chain zone_lan_forward {
|
||||
|
@ -24,7 +24,7 @@ let
|
||||
];
|
||||
in
|
||||
{
|
||||
secrix.services.systemd-networkd.secrets = let
|
||||
secrix.system.secrets = let
|
||||
pskEnabledPeers = builtins.filter (peer: peer.pskEnabled) wg0Peers;
|
||||
peerToSecretAttrs = peer: {
|
||||
name = "wg0-peer-${peer.name}-psk";
|
||||
@ -44,13 +44,13 @@ in
|
||||
Name = "wg0";
|
||||
};
|
||||
wireguardConfig = {
|
||||
PrivateKeyFile = config.secrix.services.systemd-networkd.secrets.wg0-private-key.decrypted.path;
|
||||
PrivateKeyFile = config.secrix.system.secrets.wg0-private-key.decrypted.path;
|
||||
ListenPort = 18596;
|
||||
};
|
||||
wireguardPeers = map (peer: {
|
||||
AllowedIPs = lib.strings.concatStringsSep "," peer.allowedIPs;
|
||||
AllowedIPs = peer.allowedIPs;
|
||||
PublicKey = peer.publicKey;
|
||||
PresharedKeyFile = if peer.pskEnabled then config.secrix.services.systemd-networkd.secrets."wg0-peer-${peer.name}-psk".decrypted.path else null;
|
||||
PresharedKeyFile = if peer.pskEnabled then config.secrix.system.secrets."wg0-peer-${peer.name}-psk".decrypted.path else null;
|
||||
}) wg0Peers;
|
||||
};
|
||||
};
|
||||
|
Loading…
x
Reference in New Issue
Block a user