blake/nix
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

cloudflare ddns and network forwarding fin

Browse Source
This commit is contained in:
blake
2026-04-24 16:23:49 -05:00
parent fe1242a5fd
commit db0e912139
3 changed files with 41 additions and 115 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hosts/nixos/vaniville/configuration.nix
+25 -110
View File
@@ -3,6 +3,8 @@
let
pkgs = stable_pkgs.x86_64;
unstable = unstable_pkgs.x86_64;
vpsip4 = "100.100.1.10";
homelabipv4 = "10.10.0.10";
in
{
imports =
@@ -80,19 +82,19 @@ in
externalInterface = "eth0"; # your PUBLIC_IF
internalInterfaces = [ "tailscale0" ];
forwardPorts = [
{ sourcePort = 80; destination = "10.10.0.10:80"; proto = "tcp"; } # http
{ sourcePort = 443; destination = "10.10.0.10:443"; proto = "tcp"; } # https
{ sourcePort = 25777; destination = "10.10.0.10:25777"; proto = "tcp"; } # minecraft
{ sourcePort = 25777; destination = "10.10.0.10:25777"; proto = "udp"; } # minecraft
{ sourcePort = 7567; destination = "10.10.0.10:7567"; proto = "tcp"; } # git
# { sourcePort = 80; destination = "10.10.0.10:80"; proto = "tcp"; } # http
# { sourcePort = 443; destination = "10.10.0.10:443"; proto = "tcp"; } # https
# { sourcePort = 25777; destination = "10.10.0.10:25777"; proto = "tcp"; } # minecraft
# { sourcePort = 25777; destination = "10.10.0.10:25777"; proto = "udp"; } # minecraft
# { sourcePort = 7567; destination = "10.10.0.10:7567"; proto = "tcp"; } # git
# Rustdesk ports
{ sourcePort = 21115; destination = "10.10.0.10:21115"; proto = "tcp"; }
{ sourcePort = 21116; destination = "10.10.0.10:21116"; proto = "tcp"; }
{ sourcePort = 21116; destination = "10.10.0.10:21116"; proto = "udp"; }
{ sourcePort = 21118; destination = "10.10.0.10:21118"; proto = "tcp"; }
{ sourcePort = 21117; destination = "10.10.0.10:21117"; proto = "tcp"; }
{ sourcePort = 21119; destination = "10.10.0.10:21119"; proto = "tcp"; }
# { sourcePort = 21115; destination = "10.10.0.10:21115"; proto = "tcp"; }
# { sourcePort = 21116; destination = "10.10.0.10:21116"; proto = "tcp"; }
# { sourcePort = 21116; destination = "10.10.0.10:21116"; proto = "udp"; }
# { sourcePort = 21118; destination = "10.10.0.10:21118"; proto = "tcp"; }
# { sourcePort = 21117; destination = "10.10.0.10:21117"; proto = "tcp"; }
# { sourcePort = 21119; destination = "10.10.0.10:21119"; proto = "tcp"; }
];
};
@@ -107,111 +109,24 @@ in
iptables -t nat -F
# DNAT: internet -> homelab over tailscale
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 25777 \
-j DNAT --to-destination 10.10.0.10:25777
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to-destination ${homelabipv4}:80 # http
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j DNAT --to-destination ${homelabipv4}:443 # https
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 7567 -j DNAT --to-destination ${homelabipv4}:7567 # gitea ssh
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 25777 -j DNAT --to-destination ${homelabipv4}:25777 # recpro mc
iptables -t nat -A PREROUTING -i eth0 -p udp --dport 25777 -j DNAT --to-destination ${homelabipv4}:25777 # recpro mc
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 25778 -j DNAT --to-destination ${homelabipv4}:25778 # cbblemon mc
# SNAT: ensure replies go back through VPS tailscale IP
iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 25777 \
-d 10.10.0.10/32 -j SNAT --to-source 100.100.1.10
iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 80 -d ${homelabipv4}/32 -j SNAT --to-source ${vpsip4} # http
iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 443 -d ${homelabipv4}/32 -j SNAT --to-source ${vpsip4} # https
iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 7567 -d ${homelabipv4}/32 -j SNAT --to-source ${vpsip4} # gitea ssh
iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 25777 -d ${homelabipv4}/32 -j SNAT --to-source ${vpsip4} # recpro mc
iptables -t nat -A POSTROUTING -o tailscale0 -p udp --dport 25777 -d ${homelabipv4}/32 -j SNAT --to-source ${vpsip4} # recpro mc
iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 25778 -d ${homelabipv4}/32 -j SNAT --to-source ${vpsip4} # cbblemon mc
'';
};
};
# Open ports in the firewall, the wrong way
# networking.firewall.enable = true;
# networking.firewall.extraCommands = ''
# HOMELAB_IP="10.10.0.10" # destination address
# PUBLIC_IF="eth0" # vps public interface
# TAILSCALE_IF="tailscale0" # tailscale interface
#
# # flush rules (avoid dupes)
# iptables -F
# iptables -t nat -F
# iptables -t mangle -F
# iptables -X
#
# # set defualt policies
# iptables -P INPUT DROP
# iptables -P FORWARD DROP
# iptables -P OUTPUT ACCEPT
#
# # allow loopback
# iptables -A INPUT -i lo -j ACCEPT
# iptables -A OUTPUT -o lo -j ACCEPT
#
# # allow replys
# iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
# iptables -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
#
# # allow vps outbound
# iptables -A OUTPUT -o eth0 -j ACCEPT
#
# # general settings
# sysctl -w net.ipv4.ip_forward=1 # enable ip forwarding
# iptables -t nat -A POSTROUTING -o $TAILSCALE_IF -j MASQUERADE # postrouting masquerade (outgoing packets appear to come from vps tailscale ip)
# iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT # allows pings
# iptables -A INPUT -p tcp --dport 22 -j ACCEPT # allows ssh
#
#
# # --- minecraft ---
# # port: 25777 tcp & udp
# # prerouting:
# iptables -t nat -A PREROUTING -i $PUBLIC_IF -p tcp --dport 25777 -j DNAT --to-destination $HOMELAB_IP:25777 # tcp packets on port 25777
# iptables -t nat -A PREROUTING -i $PUBLIC_IF -p udp --dport 25777 -j DNAT --to-destination $HOMELAB_IP:25777 # udp packets on port 25777
# # forwards:
# iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p tcp --dport 25777 -j ACCEPT # vps -> homelab: tcp on port 25777
# iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p udp --dport 25777 -j ACCEPT # vps -> homelab: udp on port 25777
# iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p tcp --sport 25777 -j ACCEPT # homelab -> vps: tcp on port 25777
# iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p udp --sport 25777 -j ACCEPT # homelab -> vps: udp on port 25777
#
# # --- reverse proxy ---
# # ports: 80 & 443 tcp
# # prerouting:
# iptables -t nat -A PREROUTING -i $PUBLIC_IF -p tcp --dport 80 -j DNAT --to-destination $HOMELAB_IP:80 # tcp packets on port 80
# iptables -t nat -A PREROUTING -i $PUBLIC_IF -p tcp --dport 443 -j DNAT --to-destination $HOMELAB_IP:443 # tcp packets on port 443
# # forwards:
# iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p tcp --dport 80 -j ACCEPT # vps -> homelab: tcp on port 80
# iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p tcp --sport 80 -j ACCEPT # homelab -> vps: tcp on port 80
# iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p tcp --dport 443 -j ACCEPT # vps -> homelab: tcp on port 443
# iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p tcp --sport 443 -j ACCEPT # homelab -> vps: tcp on port 443
#
# # --- gitea ssh ---
# # port: 7567 tcp
# # prerouting:
# iptables -t nat -A PREROUTING -i $PUBLIC_IF -p tcp --dport 7567 -j DNAT --to-destination $HOMELAB_IP:7567 # tcp packets on port 7567
# # forwards:
# iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p tcp --dport 7567 -j ACCEPT # vps -> homelab: tcp on port 7567
# iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p tcp --sport 7567 -j ACCEPT # homelab -> vps: tcp on port 7567
#
# # --- rustdesk ---
# # ports 2114-2119
# # hbbs ports
# # 21115 tcp (nat type test)
# iptables -t nat -A PREROUTING -i $PUBLIC_IF -p tcp --dport 21115 -j DNAT --to-destination $HOMELAB_IP:21115 # tcp packets on port 21115
# iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p tcp --dport 21115 -j ACCEPT # vps -> homelab: tcp on port 21115
# iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p tcp --sport 21115 -j ACCEPT # homelab -> vps: tcp on port 21115
# # 21116 tcp&udp (id registration, heartbeat, TCP hole punching)
# iptables -t nat -A PREROUTING -i $PUBLIC_IF -p tcp --dport 21116 -j DNAT --to-destination $HOMELAB_IP:21116 # tcp packets on port 21116
# iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p tcp --dport 21116 -j ACCEPT # vps -> homelab: tcp on port 21116
# iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p tcp --sport 21116 -j ACCEPT # homelab -> vps: tcp on port 21116
# iptables -t nat -A PREROUTING -i $PUBLIC_IF -p udp --dport 21116 -j DNAT --to-destination $HOMELAB_IP:21116 # udp packets on port 21116
# iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p udp --dport 21116 -j ACCEPT # vps -> homelab: tcp on port 21116
# iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p udp --sport 21116 -j ACCEPT # homelab -> vps: tcp on port 21116
# # 21118 tcp (web client support)
# iptables -t nat -A PREROUTING -i $PUBLIC_IF -p tcp --dport 21118 -j DNAT --to-destination $HOMELAB_IP:21118 # tcp packets on port 21118
# iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p tcp --dport 21118 -j ACCEPT # vps -> homelab: tcp on port 21118
# iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p tcp --sport 21118 -j ACCEPT # homelab -> vps: tcp on port 21118
# # hbbr ports
# # 21117 tcp (relay services)
# iptables -t nat -A PREROUTING -i $PUBLIC_IF -p tcp --dport 21117 -j DNAT --to-destination $HOMELAB_IP:21117 # tcp packets on port 21117
# iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p tcp --dport 21117 -j ACCEPT # vps -> homelab: tcp on port 21117
# iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p tcp --sport 21117 -j ACCEPT # homelab -> vps: tcp on port 21117
# # 21119 tcp (web client support)
# iptables -t nat -A PREROUTING -i $PUBLIC_IF -p tcp --dport 21119 -j DNAT --to-destination $HOMELAB_IP:21119 # tcp packets on port 21119
# iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p tcp --dport 21119 -j ACCEPT # vps -> homelab: tcp on port 21119
# iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p tcp --sport 21119 -j ACCEPT
# '';
#
system.stateVersion = "25.05"; # Did you read the comment?