47 lines
1.7 KiB
Nix
47 lines
1.7 KiB
Nix
|
|
|
|
{ config, lib, ... }:{
|
|
config = lib.mkIf (config.syscfg.server.nftables.enable) {
|
|
boot.kernel.sysctl = {
|
|
"net.ipv4.ip_forward" = 1;
|
|
"net.ipv6.conf.all.forwarding" = 1;
|
|
};
|
|
|
|
networking.nftables.enable = true;
|
|
networking.nftables.ruleset = ''
|
|
table inet filter {
|
|
chain input {
|
|
type filter hook input priority filter; policy accept;
|
|
tcp dport {5432, 6379} ip saddr { 10.0.0.0/8 169.254.0.0/16 } accept
|
|
|
|
}
|
|
}
|
|
table inet nat {
|
|
chain prerouting {
|
|
type nat hook prerouting priority dstnat; policy accept;
|
|
|
|
${lib.concatMapStringsSep "\n" (rule:
|
|
let
|
|
srcInt = builtins.elemAt rule 0;
|
|
dstAddr4 = builtins.elemAt rule 1;
|
|
dstAddr6 = builtins.elemAt rule 2;
|
|
srcPort = toString (builtins.elemAt rule 3);
|
|
dstPort = toString (builtins.elemAt rule 4);
|
|
in ''
|
|
iifname "${srcInt}" tcp dport ${srcPort} counter dnat ip to ${dstAddr4}:${dstPort}
|
|
iifname "${srcInt}" udp dport ${srcPort} counter dnat ip to ${dstAddr4}:${dstPort}
|
|
|
|
iifname "${srcInt}" tcp dport ${srcPort} counter dnat ip6 to [${dstAddr6}]:${dstPort}
|
|
iifname "${srcInt}" udp dport ${srcPort} counter dnat ip6 to [${dstAddr6}]:${dstPort}
|
|
''
|
|
) config.syscfg.server.nftables.ports}
|
|
}
|
|
|
|
chain postrouting {
|
|
type nat hook postrouting priority srcnat; policy accept;
|
|
oifname { ${lib.concatMapStringsSep ", " (iface: ''"${iface}"'') config.syscfg.server.nftables.ifs} } masquerade
|
|
}
|
|
}
|
|
'';
|
|
};
|
|
} |