mirror of
https://git.sr.ht/~magic_rb/dotfiles
synced 2024-11-25 09:36:14 +01:00
Move firewall and test microvm out into seperate files on omen
Signed-off-by: magic_rb <richard@brezak.sk>
This commit is contained in:
parent
985d7ea696
commit
ca4775b49e
|
|
@ -36,6 +36,8 @@ in
|
||||||
./users.nix
|
./users.nix
|
||||||
./nixpkgs.nix
|
./nixpkgs.nix
|
||||||
../../common/sound.nix
|
../../common/sound.nix
|
||||||
|
./firewall.nix
|
||||||
|
./microvm.nix
|
||||||
./impermenance.nix
|
./impermenance.nix
|
||||||
# ./test-vm.nix
|
# ./test-vm.nix
|
||||||
|
|
||||||
|
|
@ -80,299 +82,6 @@ in
|
||||||
|
|
||||||
virtualisation.podman.enable = true;
|
virtualisation.podman.enable = true;
|
||||||
virtualisation.podman.dockerCompat = true;
|
virtualisation.podman.dockerCompat = true;
|
||||||
|
|
||||||
nixpkgs.overlays = [
|
|
||||||
(final: prev:
|
|
||||||
let
|
|
||||||
nixpkgs = final.fetchFromGitHub {
|
|
||||||
owner = "NixOS";
|
|
||||||
repo = "nixpkgs";
|
|
||||||
rev = "2ca2346b60f72fc75bcc570367e24e1d68d55b18";
|
|
||||||
sha256 = "sha256-GNUI2MRZGe8rm27DgY503aLyXRm/Dfcao6McHrHkA7s=";
|
|
||||||
};
|
|
||||||
pkgs = import nixpkgs { system = final.stdenv.system; };
|
|
||||||
virtiofsd = pkgs.virtiofsd;
|
|
||||||
in
|
|
||||||
{
|
|
||||||
virtiofsd = final.writeShellScriptBin "virtiofsd" ''
|
|
||||||
ok_args=()
|
|
||||||
while [[ $# -gt 0 ]] ; do
|
|
||||||
case "$1" in
|
|
||||||
--posix-acl)
|
|
||||||
;;
|
|
||||||
*)
|
|
||||||
ok_args+=("$1")
|
|
||||||
;;
|
|
||||||
esac
|
|
||||||
shift 1
|
|
||||||
done
|
|
||||||
|
|
||||||
exec ${lib.getExe' "virtiofsd" virtiofsd} "''${ok_args[@]}"
|
|
||||||
'';
|
|
||||||
}
|
|
||||||
)
|
|
||||||
];
|
|
||||||
|
|
||||||
networking.notnft.rules =
|
|
||||||
let
|
|
||||||
notnft = (inputs.notnft.lib.${pkgs.stdenv.system});
|
|
||||||
logRule = with notnft.dsl; with payload; prefix:
|
|
||||||
[ (log { prefix = "${prefix} dropped: "; flags = (f: [ f.all ]); } ) ];
|
|
||||||
traceChain = with notnft.dsl; with payload;
|
|
||||||
add chain
|
|
||||||
[ (is.eq th.dport 53) (mangle meta.nftrace 1) ]
|
|
||||||
[ (is.eq th.dport 53) (mangle meta.nftrace 1) ]
|
|
||||||
[ (is.eq th.dport 22) (mangle meta.nftrace 1) ]
|
|
||||||
[ (is.eq th.sport 22) (mangle meta.nftrace 1) ]
|
|
||||||
[ (is.eq meta.oifname "mvm0") (mangle meta.nftrace 1) ]
|
|
||||||
[ (is.eq meta.iifname "mvm0") (mangle meta.nftrace 1) ];
|
|
||||||
in
|
|
||||||
# pkgs.writeText "nftables.json" (builtins.toJSON (with notnft.dsl; with payload; ruleset
|
|
||||||
with notnft.dsl; with payload; ruleset {
|
|
||||||
filter = add table { family = f: f.inet; } {
|
|
||||||
trace = traceChain;
|
|
||||||
|
|
||||||
### lo
|
|
||||||
input-lo = add chain
|
|
||||||
[ (is.ne ip.saddr (set [ "127.0.0.1" "127.0.0.53" ])) drop ]
|
|
||||||
[ (is.ne ip.daddr (set [ "127.0.0.1" "127.0.0.53" ])) drop ]
|
|
||||||
[ accept ];
|
|
||||||
|
|
||||||
output-lo = add chain
|
|
||||||
[ accept ];
|
|
||||||
###
|
|
||||||
|
|
||||||
### mvm
|
|
||||||
input-mvm = add chain
|
|
||||||
[ (is.eq ip.protocol (f: f.icmp)) accept ];
|
|
||||||
|
|
||||||
output-mvm = add chain
|
|
||||||
[ (is.eq ip.protocol (f: f.icmp)) (is.eq ip.saddr "10.80.1.1") (is.eq ip.daddr "10.80.1.2") accept ]
|
|
||||||
[ (is.eq ip.protocol (f: f.icmp)) (is.eq ip.saddr "10.80.1.2") (is.eq ip.daddr "10.80.1.1") accept ]
|
|
||||||
|
|
||||||
[ (is.eq ip.protocol (f: with f; set [ tcp ])) (is.eq th.dport 22) (is.eq ip.saddr "10.80.1.1") (is.eq ip.daddr "10.80.1.2") accept ]
|
|
||||||
[ (is.eq ip.protocol (f: with f; set [ tcp ])) (is.eq th.dport 80) (is.eq ip.saddr "10.80.1.1") (is.eq ip.daddr "10.80.1.2") accept ];
|
|
||||||
###
|
|
||||||
|
|
||||||
### wlan0
|
|
||||||
input-wlan0 = add chain
|
|
||||||
[ drop ];
|
|
||||||
|
|
||||||
output-wlan0 = add chain
|
|
||||||
[ (is.ne ip.daddr (secret.network.ips.blowhole.ip or "")) (is.eq ip.protocol (f: with f; set [ tcp udp ])) (is.eq th.dport 53) drop ]
|
|
||||||
[ accept ];
|
|
||||||
###
|
|
||||||
|
|
||||||
### wlan0
|
|
||||||
input-eth0 = add chain
|
|
||||||
[ drop ];
|
|
||||||
|
|
||||||
output-eth0 = add chain
|
|
||||||
[ (is.ne ip.daddr (secret.network.ips.blowhole.ip or "")) (is.eq ip.protocol (f: with f; set [ tcp udp ])) (is.eq th.dport 53) drop ]
|
|
||||||
[ accept ];
|
|
||||||
###
|
|
||||||
|
|
||||||
### wg0
|
|
||||||
input-wg0 = add chain
|
|
||||||
# accept syncthing sharing
|
|
||||||
[ (is.eq ip.protocol (f: f.udp)) (is.eq th.sport "22000") (is.eq th.dport "22000") accept ]
|
|
||||||
[ (is.eq ip.protocol (f: f.tcp)) (is.eq th.dport "22000") accept ]
|
|
||||||
|
|
||||||
[ (is.eq ip.protocol (f: f.icmp)) accept ];
|
|
||||||
|
|
||||||
output-wg0 = add chain
|
|
||||||
# TCP, UDP 53 to blowhole
|
|
||||||
[ (is.eq ip.protocol (f: with f; set [ udp tcp ])) (is.eq th.dport 53) (is.eq ip.saddr (secret.network.ips.omen.vpn or "")) (is.eq ip.daddr (secret.network.ips.blowhole.ip or "")) accept ]
|
|
||||||
|
|
||||||
# TCP 22, 80, 4646, 8200, 8500, 2049 to blowhole
|
|
||||||
[ (is.eq ip.protocol (f: with f; set [ tcp ])) (is.eq th.dport (set [ 22 80 4646 8200 8500 2049 ])) (is.eq ip.saddr (secret.network.ips.omen.vpn or "")) (is.eq ip.daddr (secret.network.ips.blowhole.ip or "")) accept ]
|
|
||||||
|
|
||||||
# ICMP to blowhole, toothpick
|
|
||||||
[ (is.eq ip.protocol (f: f.icmp)) (is.eq ip.saddr (secret.network.ips.omen.vpn or "")) (is.eq ip.daddr (set [ (secret.network.ips.toothpick or "") (secret.network.ips.blowhole.ip or "") ])) accept ]
|
|
||||||
|
|
||||||
# accept syncthing sharing
|
|
||||||
[ (is.eq ip.protocol (f: f.udp)) (is.eq th.sport "22000") (is.eq th.dport "22000") accept ]
|
|
||||||
[ (is.eq ip.protocol (f: f.tcp)) (is.eq th.dport "22000") accept ]
|
|
||||||
;
|
|
||||||
###
|
|
||||||
|
|
||||||
input = add chain { type = f: f.filter; hook = f: f.input; prio = -300; policy = f: f.drop; }
|
|
||||||
# accept related, established and drop invalid
|
|
||||||
[ (vmap ct.state { established = accept; related = accept; invalid = drop; }) ]
|
|
||||||
# # accept icmp between the same IP
|
|
||||||
# [ (is.eq ip.protocol (f: f.icmp)) (is.eq ip.daddr ip.saddr) accept ]
|
|
||||||
[ (jump "trace") ]
|
|
||||||
|
|
||||||
[ (is.eq meta.iifname "wlan0") (jump "input-wlan0") ]
|
|
||||||
[ (is.eq meta.iifname "eth0") (jump "input-eth0") ]
|
|
||||||
[ (is.eq meta.iifname "mvm0") (jump "input-mvm") ]
|
|
||||||
[ (is.eq meta.iifname "lo") (jump "input-lo") ]
|
|
||||||
[ (is.eq meta.iifname "wg0") (jump "input-wg0") ]
|
|
||||||
|
|
||||||
[ (is.eq ip.protocol (f: f.icmp)) accept ]
|
|
||||||
(logRule "Input");
|
|
||||||
|
|
||||||
output = add chain { type = f: f.filter; hook = f: f.output; prio = -300; policy = f: f.drop; }
|
|
||||||
[ (jump "trace") ]
|
|
||||||
|
|
||||||
[ (is.eq meta.oifname "wlan0") (jump "output-wlan0") ]
|
|
||||||
[ (is.eq meta.oifname "eth0") (jump "output-eth0") ]
|
|
||||||
[ (is.eq meta.oifname "lo") (jump "output-lo") ]
|
|
||||||
[ (is.eq meta.oifname "mvm0") (jump "output-mvm") ]
|
|
||||||
[ (is.eq meta.oifname "wg0") (jump "output-wg0") ]
|
|
||||||
(logRule "Output");
|
|
||||||
|
|
||||||
forward = add chain { type = f: f.filter; hook = f: f.forward; prio = -300; policy = f: f.drop; }
|
|
||||||
[ (jump "trace") ]
|
|
||||||
# accept masquaraded packets incoming from wg0
|
|
||||||
[ (is.eq meta.iifname "wg0") (vmap ct.state { established = accept; related = accept; }) ]
|
|
||||||
# accept TCP, UDP 53 from 10.80.1.2 to blowhole
|
|
||||||
[ (is.eq meta.iifname "mvm0") (is.eq meta.oifname "wg0") (is.eq ip.protocol (f: with f; set [ tcp udp ])) (is.eq th.dport 53) (is.eq ip.saddr "10.80.1.2") (is.eq ip.daddr (secret.network.ips.blowhole.ip or "")) accept ]
|
|
||||||
(logRule "Forward");
|
|
||||||
|
|
||||||
prerouting = add chain { type = f: f.nat; hook = f: f.prerouting; prio = -199; policy = f: f.accept; }
|
|
||||||
;
|
|
||||||
|
|
||||||
postrouting = add chain { type = f: f.nat; hook = f: f.postrouting; prio = -199; policy = f: f.accept; }
|
|
||||||
# masquarade from 10.80.1.2 heading to wg0
|
|
||||||
[ (is.eq meta.iifname "mvm0") (is.eq meta.oifname "wg0") (is.eq ip.saddr (set [ "10.80.1.2" ])) masquerade ];
|
|
||||||
};
|
|
||||||
|
|
||||||
bridge-t = add table { family = f: f.bridge; } {
|
|
||||||
trace = traceChain;
|
|
||||||
|
|
||||||
input-body = add chain;
|
|
||||||
|
|
||||||
input = add chain { type = f: f.filter; hook = f: f.input; prio = -300; policy = f: f.drop; }
|
|
||||||
[ (jump "trace") ]
|
|
||||||
[ (vmap ct.state { established = accept; related = accept; invalid = drop; }) ]
|
|
||||||
|
|
||||||
[ (is.eq meta.protocol (f: f.arp)) accept ]
|
|
||||||
|
|
||||||
[ (jump "input-body") ]
|
|
||||||
|
|
||||||
(logRule "Bridge input");
|
|
||||||
|
|
||||||
output-body = add chain;
|
|
||||||
|
|
||||||
output = add chain { type = f: f.filter; hook = f: f.output; prio = -300; policy = f: f.drop; }
|
|
||||||
[ (jump "trace") ]
|
|
||||||
|
|
||||||
[ (is.eq ether.type (f: f.arp)) accept ]
|
|
||||||
|
|
||||||
[ (jump "output-body") ]
|
|
||||||
|
|
||||||
(logRule "Bridge output");
|
|
||||||
|
|
||||||
|
|
||||||
forward-body = add chain;
|
|
||||||
|
|
||||||
forward = add chain { type = f: f.filter; hook = f: f.forward; prio = -300; policy = f: f.drop; }
|
|
||||||
[ (jump "trace") ]
|
|
||||||
|
|
||||||
[ (jump "forward-body") ]
|
|
||||||
|
|
||||||
(logRule "Bridge forward");
|
|
||||||
|
|
||||||
prerouting = add chain { type = f: f.filter; hook = f: f.prerouting; prio = -300; policy = f: f.accept; }
|
|
||||||
;
|
|
||||||
|
|
||||||
postrouting = add chain { type = f: f.filter; hook = f: f.postrouting; prio = -300; policy = f: f.accept; }
|
|
||||||
;
|
|
||||||
};
|
|
||||||
};
|
|
||||||
# ));
|
|
||||||
# };
|
|
||||||
|
|
||||||
systemd.network.netdevs."mvm0" = {
|
|
||||||
netdevConfig = {
|
|
||||||
Name = "mvm0";
|
|
||||||
Kind = "bridge";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
systemd.network.networks."10-mvm0" = {
|
|
||||||
matchConfig.Name = "mvm0";
|
|
||||||
networkConfig.Address = "10.80.1.1/24";
|
|
||||||
linkConfig.RequiredForOnline = "yes";
|
|
||||||
};
|
|
||||||
|
|
||||||
systemd.network.networks."11-mvm-test" = {
|
|
||||||
matchConfig.Name = "mvm-test";
|
|
||||||
networkConfig.Bridge = "mvm0";
|
|
||||||
linkConfig.RequiredForOnline = "no";
|
|
||||||
};
|
|
||||||
|
|
||||||
microvm.services.tcpUdp.test-ssh = {
|
|
||||||
hostName = "test";
|
|
||||||
port = 22;
|
|
||||||
protocol = [ "tcp" ];
|
|
||||||
};
|
|
||||||
|
|
||||||
microvm.services.http.test = {
|
|
||||||
hostName = "test";
|
|
||||||
port = 80;
|
|
||||||
};
|
|
||||||
|
|
||||||
microvm.services.icmp.test = {
|
|
||||||
hostName = "test";
|
|
||||||
};
|
|
||||||
|
|
||||||
microvm.connections.http = [
|
|
||||||
{
|
|
||||||
target = "test";
|
|
||||||
}
|
|
||||||
];
|
|
||||||
microvm.connections.tcpUdp = [
|
|
||||||
{
|
|
||||||
target = "test-ssh";
|
|
||||||
}
|
|
||||||
];
|
|
||||||
microvm.connections.icmp = [
|
|
||||||
{
|
|
||||||
target = "test";
|
|
||||||
}
|
|
||||||
];
|
|
||||||
|
|
||||||
microvm.vms = {
|
|
||||||
test.config = {
|
|
||||||
imports = [ inputs.self.nixosModules.microvm-extras ];
|
|
||||||
|
|
||||||
microvm = {
|
|
||||||
hostName = "test";
|
|
||||||
hostsHostName = "omen";
|
|
||||||
groupId = 1;
|
|
||||||
taskId = 2;
|
|
||||||
};
|
|
||||||
|
|
||||||
microvm.hypervisor = "cloud-hypervisor";
|
|
||||||
microvm.shares = [{
|
|
||||||
source = "/nix/store";
|
|
||||||
mountPoint = "/nix/.ro-store";
|
|
||||||
tag = "ro-store";
|
|
||||||
proto = "virtiofs";
|
|
||||||
}];
|
|
||||||
microvm.storeOnDisk = false;
|
|
||||||
|
|
||||||
networking.firewall.allowedTCPPorts = [ 80 22 ];
|
|
||||||
|
|
||||||
services.nginx = {
|
|
||||||
enable = true;
|
|
||||||
virtualHosts."example.com" = {
|
|
||||||
root = "/var/www/blog";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
users.users.root.password = "";
|
|
||||||
services.getty.helpLine = ''
|
|
||||||
Log in as "root" with an empty password.
|
|
||||||
'';
|
|
||||||
services.openssh = {
|
|
||||||
enable = true;
|
|
||||||
settings.PermitRootLogin = "yes";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
});
|
});
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
|
||||||
177
nixos/systems/omen/firewall.nix
Normal file
177
nixos/systems/omen/firewall.nix
Normal file
|
|
@ -0,0 +1,177 @@
|
||||||
|
{ secret, inputs', pkgs, ... }:
|
||||||
|
{
|
||||||
|
networking.notnft.rules =
|
||||||
|
let
|
||||||
|
notnft = (inputs'.notnft.lib.${pkgs.stdenv.system});
|
||||||
|
logRule = with notnft.dsl; with payload; prefix:
|
||||||
|
[ (log { prefix = "${prefix} dropped: "; flags = (f: [ f.all ]); } ) ];
|
||||||
|
traceChain = with notnft.dsl; with payload;
|
||||||
|
add chain
|
||||||
|
[ (is.eq th.dport 53) (mangle meta.nftrace 1) ]
|
||||||
|
[ (is.eq th.dport 53) (mangle meta.nftrace 1) ]
|
||||||
|
[ (is.eq th.dport 22) (mangle meta.nftrace 1) ]
|
||||||
|
[ (is.eq th.sport 22) (mangle meta.nftrace 1) ]
|
||||||
|
[ (is.eq meta.oifname "mvm0") (mangle meta.nftrace 1) ]
|
||||||
|
[ (is.eq meta.iifname "mvm0") (mangle meta.nftrace 1) ];
|
||||||
|
in
|
||||||
|
# pkgs.writeText "nftables.json" (builtins.toJSON (with notnft.dsl; with payload; ruleset
|
||||||
|
with notnft.dsl; with payload; ruleset {
|
||||||
|
filter = add table { family = f: f.inet; } {
|
||||||
|
trace = traceChain;
|
||||||
|
|
||||||
|
### lo
|
||||||
|
input-lo = add chain
|
||||||
|
[ (is.ne ip.saddr (set [ "127.0.0.1" "127.0.0.53" ])) drop ]
|
||||||
|
[ (is.ne ip.daddr (set [ "127.0.0.1" "127.0.0.53" ])) drop ]
|
||||||
|
[ accept ];
|
||||||
|
|
||||||
|
output-lo = add chain
|
||||||
|
[ accept ];
|
||||||
|
###
|
||||||
|
|
||||||
|
### mvm
|
||||||
|
input-mvm = add chain
|
||||||
|
[ (is.eq ip.protocol (f: f.icmp)) accept ];
|
||||||
|
|
||||||
|
output-mvm = add chain
|
||||||
|
[ (is.eq ip.protocol (f: f.icmp)) (is.eq ip.saddr "10.80.1.1") (is.eq ip.daddr "10.80.1.2") accept ]
|
||||||
|
[ (is.eq ip.protocol (f: f.icmp)) (is.eq ip.saddr "10.80.1.2") (is.eq ip.daddr "10.80.1.1") accept ]
|
||||||
|
|
||||||
|
[ (is.eq ip.protocol (f: with f; set [ tcp ])) (is.eq th.dport 22) (is.eq ip.saddr "10.80.1.1") (is.eq ip.daddr "10.80.1.2") accept ]
|
||||||
|
[ (is.eq ip.protocol (f: with f; set [ tcp ])) (is.eq th.dport 80) (is.eq ip.saddr "10.80.1.1") (is.eq ip.daddr "10.80.1.2") accept ];
|
||||||
|
###
|
||||||
|
|
||||||
|
### wlan0
|
||||||
|
input-wlan0 = add chain
|
||||||
|
[ drop ];
|
||||||
|
|
||||||
|
output-wlan0 = add chain
|
||||||
|
[ (is.ne ip.daddr (secret.network.ips.blowhole.ip or "")) (is.eq ip.protocol (f: with f; set [ tcp udp ])) (is.eq th.dport 53) drop ]
|
||||||
|
[ accept ];
|
||||||
|
###
|
||||||
|
|
||||||
|
### wlan0
|
||||||
|
input-eth0 = add chain
|
||||||
|
[ drop ];
|
||||||
|
|
||||||
|
output-eth0 = add chain
|
||||||
|
[ (is.ne ip.daddr (secret.network.ips.blowhole.ip or "")) (is.eq ip.protocol (f: with f; set [ tcp udp ])) (is.eq th.dport 53) drop ]
|
||||||
|
[ accept ];
|
||||||
|
###
|
||||||
|
|
||||||
|
### wg0
|
||||||
|
input-wg0 = add chain
|
||||||
|
# accept syncthing sharing
|
||||||
|
[ (is.eq ip.protocol (f: f.udp)) (is.eq th.sport "22000") (is.eq th.dport "22000") accept ]
|
||||||
|
[ (is.eq ip.protocol (f: f.tcp)) (is.eq th.dport "22000") accept ]
|
||||||
|
|
||||||
|
[ (is.eq ip.protocol (f: f.icmp)) accept ];
|
||||||
|
|
||||||
|
output-wg0 = add chain
|
||||||
|
# TCP, UDP 53 to blowhole
|
||||||
|
[ (is.eq ip.protocol (f: with f; set [ udp tcp ])) (is.eq th.dport 53) (is.eq ip.saddr (secret.network.ips.omen.vpn or "")) (is.eq ip.daddr (secret.network.ips.blowhole.ip or "")) accept ]
|
||||||
|
|
||||||
|
# TCP 22, 80, 4646, 8200, 8500, 2049 to blowhole
|
||||||
|
[ (is.eq ip.protocol (f: with f; set [ tcp ])) (is.eq th.dport (set [ 22 80 4646 8200 8500 2049 ])) (is.eq ip.saddr (secret.network.ips.omen.vpn or "")) (is.eq ip.daddr (secret.network.ips.blowhole.ip or "")) accept ]
|
||||||
|
|
||||||
|
# TCP 22 toothpick
|
||||||
|
[ (is.eq ip.protocol (f: with f; set [ tcp ])) (is.eq th.dport (set [ 22 ])) (is.eq ip.saddr (secret.network.ips.omen.vpn or "")) (is.eq ip.daddr (secret.network.ips.toothpick or "")) accept ]
|
||||||
|
|
||||||
|
# TCP 22 altra
|
||||||
|
[ (is.eq ip.protocol (f: with f; set [ tcp ])) (is.eq th.dport (set [ 22 ])) (is.eq ip.saddr (secret.network.ips.omen.vpn or "")) (is.eq ip.daddr (secret.network.ips.altra.ip or "")) accept ]
|
||||||
|
|
||||||
|
# ICMP to blowhole, toothpick
|
||||||
|
[ (is.eq ip.protocol (f: f.icmp)) (is.eq ip.saddr (secret.network.ips.omen.vpn or "")) (is.eq ip.daddr (set [ (secret.network.ips.toothpick or "") (secret.network.ips.altra.ip or "") (secret.network.ips.blowhole.ip or "") ])) accept ]
|
||||||
|
|
||||||
|
# accept syncthing sharing
|
||||||
|
[ (is.eq ip.protocol (f: f.udp)) (is.eq th.sport "22000") (is.eq th.dport "22000") accept ]
|
||||||
|
[ (is.eq ip.protocol (f: f.tcp)) (is.eq th.dport "22000") accept ]
|
||||||
|
;
|
||||||
|
###
|
||||||
|
|
||||||
|
input = add chain { type = f: f.filter; hook = f: f.input; prio = -300; policy = f: f.drop; }
|
||||||
|
# accept related, established and drop invalid
|
||||||
|
[ (vmap ct.state { established = accept; related = accept; invalid = drop; }) ]
|
||||||
|
# # accept icmp between the same IP
|
||||||
|
# [ (is.eq ip.protocol (f: f.icmp)) (is.eq ip.daddr ip.saddr) accept ]
|
||||||
|
[ (jump "trace") ]
|
||||||
|
|
||||||
|
[ (is.eq meta.iifname "wlan0") (jump "input-wlan0") ]
|
||||||
|
[ (is.eq meta.iifname "eth0") (jump "input-eth0") ]
|
||||||
|
[ (is.eq meta.iifname "mvm0") (jump "input-mvm") ]
|
||||||
|
[ (is.eq meta.iifname "lo") (jump "input-lo") ]
|
||||||
|
[ (is.eq meta.iifname "wg0") (jump "input-wg0") ]
|
||||||
|
|
||||||
|
[ (is.eq ip.protocol (f: f.icmp)) accept ]
|
||||||
|
(logRule "Input");
|
||||||
|
|
||||||
|
output = add chain { type = f: f.filter; hook = f: f.output; prio = -300; policy = f: f.drop; }
|
||||||
|
[ (jump "trace") ]
|
||||||
|
|
||||||
|
[ (is.eq meta.oifname "wlan0") (jump "output-wlan0") ]
|
||||||
|
[ (is.eq meta.oifname "eth0") (jump "output-eth0") ]
|
||||||
|
[ (is.eq meta.oifname "lo") (jump "output-lo") ]
|
||||||
|
[ (is.eq meta.oifname "mvm0") (jump "output-mvm") ]
|
||||||
|
[ (is.eq meta.oifname "wg0") (jump "output-wg0") ]
|
||||||
|
(logRule "Output");
|
||||||
|
|
||||||
|
forward = add chain { type = f: f.filter; hook = f: f.forward; prio = -300; policy = f: f.drop; }
|
||||||
|
[ (jump "trace") ]
|
||||||
|
# accept masquaraded packets incoming from wg0
|
||||||
|
[ (is.eq meta.iifname "wg0") (vmap ct.state { established = accept; related = accept; }) ]
|
||||||
|
# accept TCP, UDP 53 from 10.80.1.2 to blowhole
|
||||||
|
[ (is.eq meta.iifname "mvm0") (is.eq meta.oifname "wg0") (is.eq ip.protocol (f: with f; set [ tcp udp ])) (is.eq th.dport 53) (is.eq ip.saddr "10.80.1.2") (is.eq ip.daddr (secret.network.ips.blowhole.ip or "")) accept ]
|
||||||
|
(logRule "Forward");
|
||||||
|
|
||||||
|
prerouting = add chain { type = f: f.nat; hook = f: f.prerouting; prio = -199; policy = f: f.accept; }
|
||||||
|
;
|
||||||
|
|
||||||
|
postrouting = add chain { type = f: f.nat; hook = f: f.postrouting; prio = -199; policy = f: f.accept; }
|
||||||
|
# masquarade from 10.80.1.2 heading to wg0
|
||||||
|
[ (is.eq meta.iifname "mvm0") (is.eq meta.oifname "wg0") (is.eq ip.saddr (set [ "10.80.1.2" ])) masquerade ];
|
||||||
|
};
|
||||||
|
|
||||||
|
bridge-t = add table { family = f: f.bridge; } {
|
||||||
|
trace = traceChain;
|
||||||
|
|
||||||
|
input-body = add chain;
|
||||||
|
|
||||||
|
input = add chain { type = f: f.filter; hook = f: f.input; prio = -300; policy = f: f.drop; }
|
||||||
|
[ (jump "trace") ]
|
||||||
|
[ (vmap ct.state { established = accept; related = accept; invalid = drop; }) ]
|
||||||
|
|
||||||
|
[ (is.eq meta.protocol (f: f.arp)) accept ]
|
||||||
|
|
||||||
|
[ (jump "input-body") ]
|
||||||
|
|
||||||
|
(logRule "Bridge input");
|
||||||
|
|
||||||
|
output-body = add chain;
|
||||||
|
|
||||||
|
output = add chain { type = f: f.filter; hook = f: f.output; prio = -300; policy = f: f.drop; }
|
||||||
|
[ (jump "trace") ]
|
||||||
|
|
||||||
|
[ (is.eq ether.type (f: f.arp)) accept ]
|
||||||
|
|
||||||
|
[ (jump "output-body") ]
|
||||||
|
|
||||||
|
(logRule "Bridge output");
|
||||||
|
|
||||||
|
|
||||||
|
forward-body = add chain;
|
||||||
|
|
||||||
|
forward = add chain { type = f: f.filter; hook = f: f.forward; prio = -300; policy = f: f.drop; }
|
||||||
|
[ (jump "trace") ]
|
||||||
|
|
||||||
|
[ (jump "forward-body") ]
|
||||||
|
|
||||||
|
(logRule "Bridge forward");
|
||||||
|
|
||||||
|
prerouting = add chain { type = f: f.filter; hook = f: f.prerouting; prio = -300; policy = f: f.accept; }
|
||||||
|
;
|
||||||
|
|
||||||
|
postrouting = add chain { type = f: f.filter; hook = f: f.postrouting; prio = -300; policy = f: f.accept; }
|
||||||
|
;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
||||||
92
nixos/systems/omen/microvm.nix
Normal file
92
nixos/systems/omen/microvm.nix
Normal file
|
|
@ -0,0 +1,92 @@
|
||||||
|
{ inputs', ... }:
|
||||||
|
{
|
||||||
|
systemd.network.netdevs."mvm0" = {
|
||||||
|
netdevConfig = {
|
||||||
|
Name = "mvm0";
|
||||||
|
Kind = "bridge";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
systemd.network.networks."10-mvm0" = {
|
||||||
|
matchConfig.Name = "mvm0";
|
||||||
|
networkConfig.Address = "10.80.1.1/24";
|
||||||
|
linkConfig.RequiredForOnline = "yes";
|
||||||
|
};
|
||||||
|
|
||||||
|
systemd.network.networks."11-mvm-test" = {
|
||||||
|
matchConfig.Name = "mvm-test";
|
||||||
|
networkConfig.Bridge = "mvm0";
|
||||||
|
linkConfig.RequiredForOnline = "no";
|
||||||
|
};
|
||||||
|
|
||||||
|
microvm.services.tcpUdp.test-ssh = {
|
||||||
|
hostName = "test";
|
||||||
|
port = 22;
|
||||||
|
protocol = [ "tcp" ];
|
||||||
|
};
|
||||||
|
|
||||||
|
microvm.services.http.test = {
|
||||||
|
hostName = "test";
|
||||||
|
port = 80;
|
||||||
|
};
|
||||||
|
|
||||||
|
microvm.services.icmp.test = {
|
||||||
|
hostName = "test";
|
||||||
|
};
|
||||||
|
|
||||||
|
microvm.connections.http = [
|
||||||
|
{
|
||||||
|
target = "test";
|
||||||
|
}
|
||||||
|
];
|
||||||
|
microvm.connections.tcpUdp = [
|
||||||
|
{
|
||||||
|
target = "test-ssh";
|
||||||
|
}
|
||||||
|
];
|
||||||
|
microvm.connections.icmp = [
|
||||||
|
{
|
||||||
|
target = "test";
|
||||||
|
}
|
||||||
|
];
|
||||||
|
|
||||||
|
microvm.vms = {
|
||||||
|
test.config = {
|
||||||
|
imports = [ inputs'.self.nixosModules.microvm-extras ];
|
||||||
|
|
||||||
|
microvm = {
|
||||||
|
hostName = "test";
|
||||||
|
hostsHostName = "omen";
|
||||||
|
groupId = 1;
|
||||||
|
taskId = 2;
|
||||||
|
};
|
||||||
|
|
||||||
|
microvm.hypervisor = "cloud-hypervisor";
|
||||||
|
microvm.shares = [{
|
||||||
|
source = "/nix/store";
|
||||||
|
mountPoint = "/nix/.ro-store";
|
||||||
|
tag = "ro-store";
|
||||||
|
proto = "virtiofs";
|
||||||
|
}];
|
||||||
|
microvm.storeOnDisk = false;
|
||||||
|
|
||||||
|
networking.firewall.allowedTCPPorts = [ 80 22 ];
|
||||||
|
|
||||||
|
services.nginx = {
|
||||||
|
enable = true;
|
||||||
|
virtualHosts."example.com" = {
|
||||||
|
root = "/var/www/blog";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
users.users.root.password = "";
|
||||||
|
services.getty.helpLine = ''
|
||||||
|
Log in as "root" with an empty password.
|
||||||
|
'';
|
||||||
|
services.openssh = {
|
||||||
|
enable = true;
|
||||||
|
settings.PermitRootLogin = "yes";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
||||||
|
|
@ -12,6 +12,7 @@
|
||||||
emacs-rofi
|
emacs-rofi
|
||||||
tree-sitter-grammars
|
tree-sitter-grammars
|
||||||
emacs-master-nativecomp
|
emacs-master-nativecomp
|
||||||
|
virtiofsd-zfs
|
||||||
])
|
])
|
||||||
++
|
++
|
||||||
(with inputs'.nixng.overlays; [
|
(with inputs'.nixng.overlays; [
|
||||||
|
|
|
||||||
Loading…
Reference in a new issue