blake/nix
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

cloudflare ddns and network forwarding fin

Browse Source
This commit is contained in:
blake
2026-04-24 16:23:49 -05:00
parent fe1242a5fd
commit db0e912139
3 changed files with 41 additions and 115 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hosts/nixos/vaniville/configuration.nix
+25 -110
View File
@@ -3,6 +3,8 @@
let
pkgs = stable_pkgs.x86_64;
unstable = unstable_pkgs.x86_64;
vpsip4 = "100.100.1.10";
homelabipv4 = "10.10.0.10";
in
{
imports =
@@ -80,19 +82,19 @@ in
externalInterface = "eth0"; # your PUBLIC_IF
internalInterfaces = [ "tailscale0" ];
forwardPorts = [
{ sourcePort = 80; destination = "10.10.0.10:80"; proto = "tcp"; } # http
{ sourcePort = 443; destination = "10.10.0.10:443"; proto = "tcp"; } # https
{ sourcePort = 25777; destination = "10.10.0.10:25777"; proto = "tcp"; } # minecraft
{ sourcePort = 25777; destination = "10.10.0.10:25777"; proto = "udp"; } # minecraft
{ sourcePort = 7567; destination = "10.10.0.10:7567"; proto = "tcp"; } # git
# { sourcePort = 80; destination = "10.10.0.10:80"; proto = "tcp"; } # http
# { sourcePort = 443; destination = "10.10.0.10:443"; proto = "tcp"; } # https
# { sourcePort = 25777; destination = "10.10.0.10:25777"; proto = "tcp"; } # minecraft
# { sourcePort = 25777; destination = "10.10.0.10:25777"; proto = "udp"; } # minecraft
# { sourcePort = 7567; destination = "10.10.0.10:7567"; proto = "tcp"; } # git
# Rustdesk ports
{ sourcePort = 21115; destination = "10.10.0.10:21115"; proto = "tcp"; }
{ sourcePort = 21116; destination = "10.10.0.10:21116"; proto = "tcp"; }
{ sourcePort = 21116; destination = "10.10.0.10:21116"; proto = "udp"; }
{ sourcePort = 21118; destination = "10.10.0.10:21118"; proto = "tcp"; }
{ sourcePort = 21117; destination = "10.10.0.10:21117"; proto = "tcp"; }
{ sourcePort = 21119; destination = "10.10.0.10:21119"; proto = "tcp"; }
# { sourcePort = 21115; destination = "10.10.0.10:21115"; proto = "tcp"; }
# { sourcePort = 21116; destination = "10.10.0.10:21116"; proto = "tcp"; }
# { sourcePort = 21116; destination = "10.10.0.10:21116"; proto = "udp"; }
# { sourcePort = 21118; destination = "10.10.0.10:21118"; proto = "tcp"; }
# { sourcePort = 21117; destination = "10.10.0.10:21117"; proto = "tcp"; }
# { sourcePort = 21119; destination = "10.10.0.10:21119"; proto = "tcp"; }
];
};
@@ -107,111 +109,24 @@ in
iptables -t nat -F
# DNAT: internet -> homelab over tailscale
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 25777 \
-j DNAT --to-destination 10.10.0.10:25777
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to-destination ${homelabipv4}:80 # http
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j DNAT --to-destination ${homelabipv4}:443 # https
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 7567 -j DNAT --to-destination ${homelabipv4}:7567 # gitea ssh
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 25777 -j DNAT --to-destination ${homelabipv4}:25777 # recpro mc
iptables -t nat -A PREROUTING -i eth0 -p udp --dport 25777 -j DNAT --to-destination ${homelabipv4}:25777 # recpro mc
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 25778 -j DNAT --to-destination ${homelabipv4}:25778 # cbblemon mc
# SNAT: ensure replies go back through VPS tailscale IP
iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 25777 \
-d 10.10.0.10/32 -j SNAT --to-source 100.100.1.10
iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 80 -d ${homelabipv4}/32 -j SNAT --to-source ${vpsip4} # http
iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 443 -d ${homelabipv4}/32 -j SNAT --to-source ${vpsip4} # https
iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 7567 -d ${homelabipv4}/32 -j SNAT --to-source ${vpsip4} # gitea ssh
iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 25777 -d ${homelabipv4}/32 -j SNAT --to-source ${vpsip4} # recpro mc
iptables -t nat -A POSTROUTING -o tailscale0 -p udp --dport 25777 -d ${homelabipv4}/32 -j SNAT --to-source ${vpsip4} # recpro mc
iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 25778 -d ${homelabipv4}/32 -j SNAT --to-source ${vpsip4} # cbblemon mc
'';
};
};
# Open ports in the firewall, the wrong way
# networking.firewall.enable = true;
# networking.firewall.extraCommands = ''
# HOMELAB_IP="10.10.0.10" # destination address
# PUBLIC_IF="eth0" # vps public interface
# TAILSCALE_IF="tailscale0" # tailscale interface
#
# # flush rules (avoid dupes)
# iptables -F
# iptables -t nat -F
# iptables -t mangle -F
# iptables -X
#
# # set defualt policies
# iptables -P INPUT DROP
# iptables -P FORWARD DROP
# iptables -P OUTPUT ACCEPT
#
# # allow loopback
# iptables -A INPUT -i lo -j ACCEPT
# iptables -A OUTPUT -o lo -j ACCEPT
#
# # allow replys
# iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
# iptables -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
#
# # allow vps outbound
# iptables -A OUTPUT -o eth0 -j ACCEPT
#
# # general settings
# sysctl -w net.ipv4.ip_forward=1 # enable ip forwarding
# iptables -t nat -A POSTROUTING -o $TAILSCALE_IF -j MASQUERADE # postrouting masquerade (outgoing packets appear to come from vps tailscale ip)
# iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT # allows pings
# iptables -A INPUT -p tcp --dport 22 -j ACCEPT # allows ssh
#
#
# # --- minecraft ---
# # port: 25777 tcp & udp
# # prerouting:
# iptables -t nat -A PREROUTING -i $PUBLIC_IF -p tcp --dport 25777 -j DNAT --to-destination $HOMELAB_IP:25777 # tcp packets on port 25777
# iptables -t nat -A PREROUTING -i $PUBLIC_IF -p udp --dport 25777 -j DNAT --to-destination $HOMELAB_IP:25777 # udp packets on port 25777
# # forwards:
# iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p tcp --dport 25777 -j ACCEPT # vps -> homelab: tcp on port 25777
# iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p udp --dport 25777 -j ACCEPT # vps -> homelab: udp on port 25777
# iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p tcp --sport 25777 -j ACCEPT # homelab -> vps: tcp on port 25777
# iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p udp --sport 25777 -j ACCEPT # homelab -> vps: udp on port 25777
#
# # --- reverse proxy ---
# # ports: 80 & 443 tcp
# # prerouting:
# iptables -t nat -A PREROUTING -i $PUBLIC_IF -p tcp --dport 80 -j DNAT --to-destination $HOMELAB_IP:80 # tcp packets on port 80
# iptables -t nat -A PREROUTING -i $PUBLIC_IF -p tcp --dport 443 -j DNAT --to-destination $HOMELAB_IP:443 # tcp packets on port 443
# # forwards:
# iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p tcp --dport 80 -j ACCEPT # vps -> homelab: tcp on port 80
# iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p tcp --sport 80 -j ACCEPT # homelab -> vps: tcp on port 80
# iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p tcp --dport 443 -j ACCEPT # vps -> homelab: tcp on port 443
# iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p tcp --sport 443 -j ACCEPT # homelab -> vps: tcp on port 443
#
# # --- gitea ssh ---
# # port: 7567 tcp
# # prerouting:
# iptables -t nat -A PREROUTING -i $PUBLIC_IF -p tcp --dport 7567 -j DNAT --to-destination $HOMELAB_IP:7567 # tcp packets on port 7567
# # forwards:
# iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p tcp --dport 7567 -j ACCEPT # vps -> homelab: tcp on port 7567
# iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p tcp --sport 7567 -j ACCEPT # homelab -> vps: tcp on port 7567
#
# # --- rustdesk ---
# # ports 2114-2119
# # hbbs ports
# # 21115 tcp (nat type test)
# iptables -t nat -A PREROUTING -i $PUBLIC_IF -p tcp --dport 21115 -j DNAT --to-destination $HOMELAB_IP:21115 # tcp packets on port 21115
# iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p tcp --dport 21115 -j ACCEPT # vps -> homelab: tcp on port 21115
# iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p tcp --sport 21115 -j ACCEPT # homelab -> vps: tcp on port 21115
# # 21116 tcp&udp (id registration, heartbeat, TCP hole punching)
# iptables -t nat -A PREROUTING -i $PUBLIC_IF -p tcp --dport 21116 -j DNAT --to-destination $HOMELAB_IP:21116 # tcp packets on port 21116
# iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p tcp --dport 21116 -j ACCEPT # vps -> homelab: tcp on port 21116
# iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p tcp --sport 21116 -j ACCEPT # homelab -> vps: tcp on port 21116
# iptables -t nat -A PREROUTING -i $PUBLIC_IF -p udp --dport 21116 -j DNAT --to-destination $HOMELAB_IP:21116 # udp packets on port 21116
# iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p udp --dport 21116 -j ACCEPT # vps -> homelab: tcp on port 21116
# iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p udp --sport 21116 -j ACCEPT # homelab -> vps: tcp on port 21116
# # 21118 tcp (web client support)
# iptables -t nat -A PREROUTING -i $PUBLIC_IF -p tcp --dport 21118 -j DNAT --to-destination $HOMELAB_IP:21118 # tcp packets on port 21118
# iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p tcp --dport 21118 -j ACCEPT # vps -> homelab: tcp on port 21118
# iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p tcp --sport 21118 -j ACCEPT # homelab -> vps: tcp on port 21118
# # hbbr ports
# # 21117 tcp (relay services)
# iptables -t nat -A PREROUTING -i $PUBLIC_IF -p tcp --dport 21117 -j DNAT --to-destination $HOMELAB_IP:21117 # tcp packets on port 21117
# iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p tcp --dport 21117 -j ACCEPT # vps -> homelab: tcp on port 21117
# iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p tcp --sport 21117 -j ACCEPT # homelab -> vps: tcp on port 21117
# # 21119 tcp (web client support)
# iptables -t nat -A PREROUTING -i $PUBLIC_IF -p tcp --dport 21119 -j DNAT --to-destination $HOMELAB_IP:21119 # tcp packets on port 21119
# iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p tcp --dport 21119 -j ACCEPT # vps -> homelab: tcp on port 21119
# iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p tcp --sport 21119 -j ACCEPT
# '';
#
system.stateVersion = "25.05"; # Did you read the comment?
modules/homelab/ddns/default.nix
+13 -2
View File
@@ -6,6 +6,7 @@
}: let
cfg = config.homelab.ddns;
token = config.sops.secrets."cloudflare/api_token".path;
sec = config.sops.secrets;
in {
options.homelab.ddns = {
enable = lib.mkEnableOption "enables ddns with cloudflare";
@@ -16,10 +17,20 @@ in {
enable = true;
credentialsFile = token;
domains = [
# recoil.pro
"recoil.pro"
"*.recoil.pro"
"mc.recoil.pro"
"smp.recoil.pro"
"superflat.recoil.pro"
"skyblock.recoil.pro"
"cobblemon.recoil.pro"
# blakedheld.xyz
"blakedheld.xyz"
"*.blakedheld.xyz"
"git.blakedheld.xyz"
];
};
@@ -28,8 +39,8 @@ in {
# declare authkey secrets
sops.secrets = {
"cloudflare/api_token" = {
owner = "root";
group = "cloudflare-ddns"
owner = "cloudflare-ddns";
group = "cloudflare-ddns";
};
};
};
secrets/secrets.yaml
+3 -3
View File
@@ -8,7 +8,7 @@ tailscale_authkey: ENC[AES256_GCM,data:SqBbzV43arnLJZX0bnCZZGqO3jAKXBPZvIe6lqtf8
borg_passwd: ENC[AES256_GCM,data:XOMJtr+DRs7xn5Iclc49iTzK9cFJyc/fSXJjhdKa9jdN,iv:YB8z7zNYjh6NpSxQb1TfPxAYUdzThdVfNZIe6tO5grA=,tag:bO6kZ3cLJDL4IQoWmGvRdg==,type:str]
#ENC[AES256_GCM,data:NbXyRroLF2uxHjROnBg9OLQ=,iv:W9Nse9yamov3rflDKBeISO+miQkjH7QfBUZdsDmDM4I=,tag:/RmH3JyriXFxf0hEh9/iRQ==,type:comment]
cloudflare:
api_token: ENC[AES256_GCM,data:U6R/LUfh+0i7ylqgoSaacV8zwoT+sl1d/ek9E/zeYUlZbSyUF+WGJQ==,iv:w1hqIfUYCemq/7Oc3nyxIFNomR4wen+rFstNDXkjlS8=,tag:WMWsi1j2YNXfVgt1Lw/bwQ==,type:str]
api_token: ENC[AES256_GCM,data:VuRwfZe1cdnQLvxlp9GCDOt9Ijhz4fh2yOev2wLOdLV+zw91blA3Zis2BRyI/ZwN4y+IhiqlpBzXCsoFqw==,iv:6Bt11zz1/slvszh9ZGQ0ov5ts0jAZIAMx3G2AimKIs4=,tag:tyEVhsKCGrJWm6yn+GUlUQ==,type:str]
#ENC[AES256_GCM,data:ztRwuY0mTMDmwV5HqVR7Dmc+dCWcrVRtWZGEL1abE/WUcA==,iv:mmaWfHRiENJUGNhyUBFo1z7PdzVPH1OUZrVhkce6KV0=,tag:GKEvT0qkzTtimQXDueKPdw==,type:comment]
holocron_creds: ENC[AES256_GCM,data:2QXtXrN5w0UFn70GZOsYFPdtPwjLcuUdtkEam5aZ83N6LEDqPWJi,iv:kUS9pq5CX19vqHumc6QjY+Xpd4N+Ge7oCcQYtMFh+WM=,tag:IUA1ZVThF91EdHrwmS624g==,type:str]
#ENC[AES256_GCM,data:VdbMrwGKUKNJHw==,iv:OLwBh6KQXR/H8eRgp/hH8k3QfIkK/ydL735kx/dpc8E=,tag:N+v+ym6RMbvW4IckbiLK8Q==,type:comment]
@@ -69,7 +69,7 @@ sops:
U0tmdFBuZnJES3piOTZNV0VKQmQ0eVUKCWRQ/flLzmpC64WyLoipklZBmrkpYiUg
PRu+itNolpPTHm96pe+P93g2iP0wgekG0cX21wkiU2xaLF3dY2FEIA==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2026-04-24T20:37:31Z"
mac: ENC[AES256_GCM,data:42SLBYbKdUjXuCM7Ixn58WGFKCZMMcVGEDipAIqY3zDw++s8rNQpQVu3sN+2GhfPWw260uttfHbbs/li5JUtTwG1IP3nDW9UsWy5NE7BOKBwma/geRCDoovIfBkIKKt0jdS9ifI5twUeoVf4Pg0XqwaK73+IHHE3kngOQm3CS1M=,iv:MWX4Ccc1s2o7w1u9chjYDDBNrV8JB/FeTxeBk54Xue0=,tag:83TkRHAsnKurxiF+SrhqOQ==,type:str]
lastmodified: "2026-04-24T20:55:52Z"
mac: ENC[AES256_GCM,data:1nAqh19Q0J9zJLtQJXAS4zGbFiRltxyZd9HvdrH6w3ViSi1T/TxpYax5t7dsgkFVitPstWzIek/K653mLt8xnIc1djImdx5POb96WKlTj8gx/Z/p+iCgrBuWB3tPnj8C2XGbSlX9YukzF3TvCXdN+W18x88Z2b/NHNaxhtwY844=,iv:LHndsg1LwGFPAAFGu/t/F+dSSfEAvF/cN4XnzI1QchQ=,tag:/8Ec+g4n4sXDVrM1f+HZkA==,type:str]
unencrypted_suffix: _unencrypted
version: 3.12.1