WIP: router: firewall: proper filtering for hosts proxied by cloudflare

flake.lock

@@ -7,11 +7,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1741791118,
-        "narHash": "sha256-4Y427uj0eql4yRU5rely3EcOlB9q457UDbG9omPtXiA=",
+        "lastModified": 1742957044,
+        "narHash": "sha256-gwW0tBIA77g6qq45y220drTy0DmThF3fJMwVFUtYV9c=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "18780912345970e5b546b1b085385789b6935a83",
+        "rev": "ce287a5cd3ef78203bc78021447f937a988d9f6f",
         "type": "github"
       },
       "original": {
@@ -43,11 +43,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1740947705,
-        "narHash": "sha256-Co2kAD2SZalOm+5zoxmzEVZNvZ17TyafuFsD46BwSdY=",
+        "lastModified": 1742568034,
+        "narHash": "sha256-QaMEhcnscfF2MqB7flZr+sLJMMYZPnvqO4NYf9B4G38=",
         "owner": "nix-community",
         "repo": "nixos-generators",
-        "rev": "507911df8c35939050ae324caccc7cf4ffb76565",
+        "rev": "42ee229088490e3777ed7d1162cb9e9d8c3dbb11",
         "type": "github"
       },
       "original": {
@@ -58,11 +58,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1741513245,
-        "narHash": "sha256-7rTAMNTY1xoBwz0h7ZMtEcd8LELk9R5TzBPoHuhNSCk=",
+        "lastModified": 1742669843,
+        "narHash": "sha256-G5n+FOXLXcRx+3hCJ6Rt6ZQyF1zqQ0DL0sWAMn2Nk0w=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "e3e32b642a31e6714ec1b712de8c91a3352ce7e1",
+        "rev": "1e5b653dff12029333a6546c11e108ede13052eb",
         "type": "github"
       },
       "original": {
@@ -82,11 +82,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1740569341,
-        "narHash": "sha256-WV8nY2IOfWdzBF5syVgCcgOchg/qQtpYh6LECYS9XkY=",
+        "lastModified": 1742765550,
+        "narHash": "sha256-2vVIh2JrL6GAGfgCeY9e6iNKrBjs0Hw3bGQEAbwVs68=",
         "owner": "nix-community",
         "repo": "plasma-manager",
-        "rev": "5eeb0172fb74392053b66a8149e61b5e191b2845",
+        "rev": "b70be387276e632fe51232887f9e04e2b6ef8c16",
         "type": "github"
       },
       "original": {

hosts/router/dns.nix

@@ -51,6 +51,10 @@ in
         "tls://one.one.one.one"
         "tls://dns.quad9.net"
 
+        # Adguard uses upstream and not rewrite rules to resolve cname rewrites,
+        # and obviously my sysdomain entries don't exist in cloudflare.
+        "[/${sysdomain}/][::1]"           # Sys domains to self (for cname rewrites)
+
         "[/${ldomain}/][::1]:1053"        # Local domains to Knot (ddns)
         "[/home/][${ifs.lan.ulaPrefix}::250]"  # .home domains to opnsense (temporary)
       ];
@@ -63,26 +67,27 @@ in
       "|pve-3.${sysdomain}^$dnsrewrite=${ifs.lan.p4}.7"
       "|pve-1.${sysdomain}^$dnsrewrite=${vars.hosts.lan.pve-1.ulaAddr}"
       "|pve-3.${sysdomain}^$dnsrewrite=${ifs.lan.ulaPrefix}::7:1"
-      # This double cname thing doesn't work btw, TODO: remove
-      "|debbi.${sysdomain}^$dnsrewrite=debbi.4.${ifs.lan.domain}"
-      "|debbi.${sysdomain}^$dnsrewrite=debbi.6.${ifs.lan.domain}"
+      "|truenas.${sysdomain}^$dnsrewrite=${ifs.lan.p4}.10"
+      "|truenas.${sysdomain}^$dnsrewrite=${ifs.lan.ulaPrefix}::20d0:43ff:fec6:3192"
+      "|debbi.${sysdomain}^$dnsrewrite=${ifs.lan.p4}.11"
+      "|debbi.${sysdomain}^$dnsrewrite=${ifs.lan.ulaPrefix}::11:1"
+      "|etappi.${sysdomain}^$dnsrewrite=${ifs.lan.p4}.12"
+      "|etappi.${sysdomain}^$dnsrewrite=${ifs.lan.ulaPrefix}::12:1"
 
-      "||lab.${domain}^$dnsrewrite=${ifs.lan.p6}::12:1"
-      "||lab.${domain}^$dnsrewrite=${ifs.lan.p4}.12"
+      # Lab DNS rewrites
+      "||lab.${domain}^$dnsrewrite=etappi.${sysdomain}"
 
       # Allowed exceptions
       "@@||googleads.g.doubleclick.net"
     ]
       # Alpina DNS rewrites
-      ++ map (host: "${host}${domain}^$dnsrewrite=${ifs.lan.p6}:1cd5:56ff:feec:c74a") alpinaDomains
-      ++ map (host: "${host}${domain}^$dnsrewrite=${ifs.lan.p4}.11") alpinaDomains;
+      ++ map (host: "${host}${domain}^$dnsrewrite=debbi.${sysdomain}") alpinaDomains;
   };
 
   services.knot.enable = true;
   services.knot.settings = {
     # server.listen = "0.0.0.0@1053";
     server.listen = "::1@1053";
-    # TODO: templates
     zone = [
       {
         domain = ldomain;

hosts/router/firewall.nix

@@ -26,6 +26,17 @@ in
           $OPNSENSE_NET6,
       }
       define RFC1918 = { 10.0.0.0/8, 172.12.0.0/12, 192.168.0.0/16 }
+      define CLOUDFLARE_NET6 = {
+          # https://www.cloudflare.com/ips-v6
+          # TODO: figure out a better way to get addrs dynamically from url
+          2400:cb00::/32,
+          2606:4700::/32,
+          2803:f800::/32,
+          2405:b500::/32,
+          2405:8100::/32,
+          2a06:98c0::/29,
+          2c0f:f248::/32,
+      }
 
       define ALLOWED_TCP_PORTS = { ssh, https }
       define ALLOWED_UDP_PORTS = { bootps, dhcpv6-server, domain }
@@ -38,9 +49,12 @@ in
       }
       set port_forward_v6 {
           type inet_proto . ipv6_addr . inet_service
+          # elements = {}
+      }
+      set cloudflare_forward_v6 {
+          type ipv6_addr
           elements = {
-              tcp . ${ifs.lan.p6}::11:1 . https,
-              tcp . ${ifs.lan.p6}:1cd5:56ff:feec:c74a . https,
+              ${ifs.lan.p6}::11:1,
           }
       }
 
@@ -109,6 +123,9 @@ in
 
           # Allowed IPv6 ports
           meta l4proto . ip6 daddr . th dport @port_forward_v6 accept
+
+          # Allowed IPv6 from cloudflare
+          ip6 saddr $CLOUDFLARE_NET6 ip6 daddr @cloudflare_forward_v6 accept
       }
 
       chain zone_lan_input {