finalize netconfig simplification
This commit is contained in:
RootHost-Stormwind
@@ -6,7 +6,7 @@
|
||||
# fsType = "nfs";
|
||||
#};
|
||||
"/mnt/nethergarde/leonhome" = {
|
||||
device = "10.46.32.2:/mnt/Nethergarde/Home";
|
||||
device = "192.168.0.16:/mnt/Nethergarde/Home";
|
||||
fsType = "nfs";
|
||||
};
|
||||
#"/mnt/nethergarde/bigdata" = {
|
||||
|
||||
@@ -41,6 +41,9 @@
|
||||
|
||||
boot.kernel.sysctl = {
|
||||
"net.ipv4.conf.all.forwarding" = true;
|
||||
"net.bridge.bridge-nf-call-iptables" = 0;
|
||||
"net.bridge.bridge-nf-call-ip6tables" = 0;
|
||||
"net.bridge.bridge-nf-call-arptables" = 0;
|
||||
};
|
||||
|
||||
swapDevices =
|
||||
|
||||
44
incus.nix
44
incus.nix
@@ -3,33 +3,41 @@
|
||||
{
|
||||
virtualisation.incus.enable = true;
|
||||
networking = {
|
||||
nftables.enable = true;
|
||||
firewall = {
|
||||
trustedInterfaces = [ "incusbr1" "incusbr2" ];
|
||||
filterForward = true;
|
||||
nftables = {
|
||||
enable = true;
|
||||
ruleset = ''
|
||||
table inet crusader_isolation {
|
||||
chain fwd_pre {
|
||||
type filter hook forward priority -200; policy accept;
|
||||
|
||||
extraForwardRules = ''
|
||||
# if crusader tries to go to varian or truenas, BLOCK
|
||||
iifname "incusbr1" oifname "incusbr0" drop
|
||||
iifname "incusbr1" oifname "incusbr2" ip daddr 192.168.0.0/16 drop
|
||||
# Crusader-Netz darf NICHT ins LAN
|
||||
iifname "incusbr1" ip daddr 192.168.0.0/16 drop
|
||||
}
|
||||
}
|
||||
'';
|
||||
}
|
||||
firewall = {
|
||||
trustedInterfaces = [ "incusbr2" ];
|
||||
filterForward = false;
|
||||
|
||||
interfaces = {
|
||||
incusbr0 = {
|
||||
allowedTCPPorts = [ 53 67 ];
|
||||
allowedUDPPorts = [ 53 67 ];
|
||||
};
|
||||
incusbr1 = {
|
||||
allowedTCPPorts = [ 53 ];
|
||||
allowedUDPPorts = [ 53 67 68 ];
|
||||
};
|
||||
incusbr2 = {
|
||||
allowedTCPPorts = [ 53 ];
|
||||
allowedUDPPorts = [ 53 67 68 ];
|
||||
allowedUDPPorts = [
|
||||
53
|
||||
67
|
||||
68
|
||||
41641 # Tailscale / WireGuard
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
|
||||
nat = {
|
||||
enable = true;
|
||||
externalInterface = "incusbr2";
|
||||
internalInterfaces = [ "incusbr1" ];
|
||||
internalIPs = [ "10.46.33.0/24" ];
|
||||
};
|
||||
};
|
||||
|
||||
|
||||
226
networking.nix
226
networking.nix
@@ -9,68 +9,11 @@
|
||||
|
||||
firewall = {
|
||||
enable = true;
|
||||
allowedTCPPorts = [ 53 80 443 8123 1883 8883 9001 20 21 50000 50001 50002 50003 50004 50005 22 2222 2223 990 989 445 111 2049 32765 32768 20048 ];
|
||||
allowedUDPPorts = [ 53 67 68 111 2049 20048 32765 32768 ];
|
||||
allowedTCPPorts = [ 53 2222 ];
|
||||
allowedUDPPorts = [ 53 67 68 ];
|
||||
};
|
||||
|
||||
nftables.ruleset = ''
|
||||
table ip filter {
|
||||
chain forward {
|
||||
type filter hook forward priority 0; policy drop;
|
||||
# allow established/related replies
|
||||
ct state established,related accept
|
||||
|
||||
# allow new+established VM→Internet
|
||||
iifname "incusbr0" oifname "incusbr2" ct state new,established accept
|
||||
iifname "incusbr1" oifname "incusbr2" ct state new,established accept
|
||||
|
||||
# allow vm to vm communication
|
||||
iifname "tap*" oifname "tap*" accept
|
||||
|
||||
# allow vm dns
|
||||
ether saddr 10:66:6a:06:f9:5e udp dport 53 accept
|
||||
|
||||
# allow vms on incusbr2 to go into lan
|
||||
iifname "incusbr2" accept
|
||||
|
||||
# allow natted replies
|
||||
iifname "incusbr2" oifname "incusbr0" tcp dport 8123 ct state new,established accept
|
||||
iifname "incusbr2" oifname "incusbr0" tcp dport 80 ct state new,established accept
|
||||
iifname "incusbr2" oifname "incusbr0" tcp dport 443 ct state new,established accept
|
||||
iifname "incusbr2" oifname "incusbr0" tcp dport 1883 ct state new,established accept
|
||||
iifname "incusbr2" oifname "incusbr0" tcp dport 8883 ct state new,established accept
|
||||
iifname "incusbr2" oifname "incusbr0" tcp dport 9001 ct state new,established accept
|
||||
iifname "incusbr2" oifname "incusbr0" tcp dport 20 ct state new,established accept
|
||||
iifname "incusbr2" oifname "incusbr0" tcp dport 21 ct state new,established accept
|
||||
iifname "incusbr2" oifname "incusbr0" tcp dport 50000 ct state new,established accept
|
||||
iifname "incusbr2" oifname "incusbr0" tcp dport 50001 ct state new,established accept
|
||||
iifname "incusbr2" oifname "incusbr0" tcp dport 50002 ct state new,established accept
|
||||
iifname "incusbr2" oifname "incusbr0" tcp dport 50003 ct state new,established accept
|
||||
iifname "incusbr2" oifname "incusbr0" tcp dport 50004 ct state new,established accept
|
||||
iifname "incusbr2" oifname "incusbr0" tcp dport 50005 ct state new,established accept
|
||||
iifname "incusbr2" oifname "incusbr0" tcp dport 22 ct state new,established accept
|
||||
iifname "incusbr2" oifname "incusbr0" tcp dport 2223 ct state new,established accept
|
||||
iifname "incusbr2" oifname "incusbr0" tcp dport 990 ct state new,established accept
|
||||
iifname "incusbr2" oifname "incusbr0" tcp dport 989 ct state new,established accept
|
||||
iifname "incusbr2" oifname "incusbr0" tcp dport 445 ct state new,established accept
|
||||
iifname "incusbr2" oifname "incusbr0" tcp dport 111 ct state new,established accept
|
||||
iifname "incusbr2" oifname "incusbr0" udp dport 111 ct state new,established accept
|
||||
iifname "incusbr2" oifname "incusbr0" tcp dport 2049 ct state new,established accept
|
||||
iifname "incusbr2" oifname "incusbr0" udp dport 2049 ct state new,established accept
|
||||
iifname "incusbr2" oifname "incusbr0" tcp dport 32765 ct state new,established accept
|
||||
iifname "incusbr2" oifname "incusbr0" udp dport 32765 ct state new,established accept
|
||||
iifname "incusbr2" oifname "incusbr0" tcp dport 32768 ct state new,established accept
|
||||
iifname "incusbr2" oifname "incusbr0" udp dport 32768 ct state new,established accept
|
||||
iifname "incusbr2" oifname "incusbr0" tcp dport 20048 ct state new,established accept
|
||||
iifname "incusbr2" oifname "incusbr0" udp dport 20048 ct state new,established accept
|
||||
}
|
||||
}
|
||||
'';
|
||||
|
||||
bridges = {
|
||||
incusbr0 = {
|
||||
interfaces = [];
|
||||
};
|
||||
incusbr1 = {
|
||||
interfaces = [];
|
||||
};
|
||||
@@ -80,11 +23,6 @@
|
||||
};
|
||||
|
||||
interfaces = {
|
||||
incusbr0 = {
|
||||
ipv4.addresses = [
|
||||
{ address = "10.46.32.1"; prefixLength = 24; }
|
||||
];
|
||||
};
|
||||
incusbr1 = {
|
||||
ipv4.addresses = [
|
||||
{ address = "10.46.33.1"; prefixLength = 24; }
|
||||
@@ -102,166 +40,6 @@
|
||||
address = "192.168.0.1";
|
||||
interface = "incusbr2";
|
||||
};
|
||||
|
||||
nat = {
|
||||
enable = true;
|
||||
internalInterfaces = [ "incusbr0" "incusbr1" ];
|
||||
externalInterface = "incusbr2";
|
||||
forwardPorts = [
|
||||
# Web-UI for home-assistant
|
||||
{
|
||||
sourcePort = 8123;
|
||||
proto = "tcp";
|
||||
destination = "10.46.32.153:8123";
|
||||
}
|
||||
# Web-UI for nas
|
||||
{
|
||||
sourcePort = 80;
|
||||
proto = "tcp";
|
||||
destination = "10.46.32.2:80";
|
||||
}
|
||||
{
|
||||
sourcePort = 443;
|
||||
proto = "tcp";
|
||||
destination = "10.46.32.2:443";
|
||||
}
|
||||
# MQTT
|
||||
{
|
||||
sourcePort = 1883;
|
||||
proto = "tcp";
|
||||
destination = "10.46.32.153:1883";
|
||||
}
|
||||
{
|
||||
sourcePort = 8883;
|
||||
proto = "tcp";
|
||||
destination = "10.46.32.153:8883";
|
||||
}
|
||||
{
|
||||
sourcePort = 9001;
|
||||
proto = "tcp";
|
||||
destination = "10.46.32.153:9001";
|
||||
}
|
||||
# FTP
|
||||
{
|
||||
sourcePort = 20;
|
||||
proto = "tcp";
|
||||
destination = "10.46.32.2:20";
|
||||
}
|
||||
{
|
||||
sourcePort = 21;
|
||||
proto = "tcp";
|
||||
destination = "10.46.32.2:21";
|
||||
}
|
||||
# FTP Passive Ports
|
||||
{
|
||||
sourcePort = 50000;
|
||||
proto = "tcp";
|
||||
destination = "10.46.32.2:50000";
|
||||
}
|
||||
{
|
||||
sourcePort = 50001;
|
||||
proto = "tcp";
|
||||
destination = "10.46.32.2:50001";
|
||||
}
|
||||
{
|
||||
sourcePort = 50002;
|
||||
proto = "tcp";
|
||||
destination = "10.46.32.2:50002";
|
||||
}
|
||||
{
|
||||
sourcePort = 50003;
|
||||
proto = "tcp";
|
||||
destination = "10.46.32.2:50003";
|
||||
}
|
||||
{
|
||||
sourcePort = 50004;
|
||||
proto = "tcp";
|
||||
destination = "10.46.32.2:50004";
|
||||
}
|
||||
{
|
||||
sourcePort = 50005;
|
||||
proto = "tcp";
|
||||
destination = "10.46.32.2:50005";
|
||||
}
|
||||
{
|
||||
sourcePort = 22;
|
||||
proto = "tcp";
|
||||
destination = "10.46.32.2:22";
|
||||
}
|
||||
{
|
||||
sourcePort = 2223;
|
||||
proto = "tcp";
|
||||
destination = "10.46.32.2:2223";
|
||||
}
|
||||
{
|
||||
sourcePort = 990;
|
||||
proto = "tcp";
|
||||
destination = "10.46.32.2:990";
|
||||
}
|
||||
{
|
||||
sourcePort = 989;
|
||||
proto = "tcp";
|
||||
destination = "10.46.32.2:989";
|
||||
}
|
||||
# SMB
|
||||
{
|
||||
sourcePort = 445;
|
||||
proto = "tcp";
|
||||
destination = "10.46.32.2:445";
|
||||
}
|
||||
# NFS
|
||||
{
|
||||
sourcePort = 111;
|
||||
proto = "tcp";
|
||||
destination = "10.46.32.2:111";
|
||||
}
|
||||
{
|
||||
sourcePort = 111;
|
||||
proto = "udp";
|
||||
destination = "10.46.32.2:111";
|
||||
}
|
||||
{
|
||||
sourcePort = 2049;
|
||||
proto = "tcp";
|
||||
destination = "10.46.32.2:2049";
|
||||
}
|
||||
{
|
||||
sourcePort = 2049;
|
||||
proto = "udp";
|
||||
destination = "10.46.32.2:2049";
|
||||
}
|
||||
{
|
||||
sourcePort = 32765;
|
||||
proto = "tcp";
|
||||
destination = "10.46.32.2:32765";
|
||||
}
|
||||
{
|
||||
sourcePort = 32765;
|
||||
proto = "udp";
|
||||
destination = "10.46.32.2:32765";
|
||||
}
|
||||
{
|
||||
sourcePort = 32768;
|
||||
proto = "tcp";
|
||||
destination = "10.46.32.2:32768";
|
||||
}
|
||||
{
|
||||
sourcePort = 32768;
|
||||
proto = "udp";
|
||||
destination = "10.46.32.2:32768";
|
||||
}
|
||||
{
|
||||
sourcePort = 20048;
|
||||
proto = "tcp";
|
||||
destination = "10.46.32.2:20048";
|
||||
}
|
||||
{
|
||||
sourcePort = 20048;
|
||||
proto = "udp";
|
||||
destination = "10.46.32.2:20048";
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user