Deuxfleurs/nixcfg
17
6
Fork 2
Code Issues 15 Pull requests 2 Projects Releases Wiki Activity

Configure firewall

Browse source
This commit is contained in:
Alex 2021-12-13 11:30:41 +01:00
parent 22dc7adc4c
commit 860f69adb6
No known key found for this signature in database
GPG key ID: EDABF9711E244EB1
4 changed files with 56 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

50
configuration.nix
View file

@ -263,18 +263,44 @@ in
}; };
# Open ports in the firewall. # Open ports in the firewall.
networking.firewall.allowedTCPPorts = [ networking.firewall = {
(builtins.head ({ openssh.ports = [22]; } // node_config.services).openssh.ports) allowedTCPPorts = [
3990 3991 3992 # Garage (builtins.head ({ openssh.ports = [22]; } // node_config.services).openssh.ports)
4646 4647 4648 # Nomad #3990 3991 3992 # Garage
8500 8300 8301 8302 # Consul #4646 4647 4648 # Nomad
19999 # Netdata #8500 8300 8301 8302 # Consul
]; #19999 # Netdata
networking.firewall.allowedUDPPorts = [ ];
4648 # Nomad allowedUDPPorts = [
8301 8302 # Consul #4648 # Nomad
node_config.networking.wireguard.interfaces.wg0.listenPort #8301 8302 # Consul
]; node_config.networking.wireguard.interfaces.wg0.listenPort
];
extraCommands = ''
iptables -N VPN
iptables -A INPUT -s 10.42.0.0/16 -j VPN
iptables -A VPN -p tcp --dport 3990 -j ACCEPT
iptables -A VPN -p tcp --dport 3991 -j ACCEPT
iptables -A VPN -p tcp --dport 3992 -j ACCEPT
iptables -A VPN -p tcp --dport 4646 -j ACCEPT
iptables -A VPN -p tcp --dport 4647 -j ACCEPT
iptables -A VPN -p tcp --dport 4648 -j ACCEPT
iptables -A VPN -p udp --dport 4648 -j ACCEPT
iptables -A VPN -p tcp --dport 8500 -j ACCEPT
iptables -A VPN -p tcp --dport 8300 -j ACCEPT
iptables -A VPN -p tcp --dport 8301 -j ACCEPT
iptables -A VPN -p tcp --dport 8302 -j ACCEPT
iptables -A VPN -p udp --dport 8301 -j ACCEPT
iptables -A VPN -p udp --dport 8302 -j ACCEPT
iptables -A VPN -p tcp --dport 19999 -j ACCEPT
'';
#flush the chain then remove it
extraStopCommands = ''
iptables -D INPUT -s 10.42.0.0/16 -j VPN
iptables -F VPN
iptables -X VPN
'';
};
# Or disable the firewall altogether. # Or disable the firewall altogether.
# networking.firewall.enable = false; # networking.firewall.enable = false;

6
node/carcajou.nix
View file

@ -17,6 +17,12 @@
prefixLength = 24; prefixLength = 24;
} }
]; ];
networking.interfaces.eno1.ipv6.addresses = [
{
address = "2a01:e0a:c:a720::22";
prefixLength = 64;
}
];
networking.wireguard.interfaces.wg0 = { networking.wireguard.interfaces.wg0 = {
ips = [ "10.42.0.22/16" ]; ips = [ "10.42.0.22/16" ];

6
node/cariacou.nix
View file

@ -17,6 +17,12 @@
prefixLength = 24; prefixLength = 24;
} }
]; ];
networking.interfaces.eno1.ipv6.addresses = [
{
address = "2a01:e0a:c:a720::21";
prefixLength = 64;
}
];
networking.wireguard.interfaces.wg0 = { networking.wireguard.interfaces.wg0 = {
ips = [ "10.42.0.21/16" ]; ips = [ "10.42.0.21/16" ];

6
node/caribou.nix
View file

@ -17,6 +17,12 @@
prefixLength = 24; prefixLength = 24;
} }
]; ];
networking.interfaces.eno1.ipv6.addresses = [
{
address = "2a01:e0a:c:a720::23";
prefixLength = 64;
}
];
networking.wireguard.interfaces.wg0 = { networking.wireguard.interfaces.wg0 = {
ips = [ "10.42.0.23/16" ]; ips = [ "10.42.0.23/16" ];