prep for vaniville to be nix
This commit is contained in:
@@ -49,101 +49,132 @@ in
|
||||
# enable flakes
|
||||
nix.settings.experimental-features = [ "nix-command" "flakes" ];
|
||||
|
||||
# Open ports in the firewall.
|
||||
networking.firewall.enable = true;
|
||||
networking.firewall.extraCommands = ''
|
||||
HOMELAB_IP="10.10.0.10" # destination address
|
||||
PUBLIC_IF="eth0" # vps public interface
|
||||
TAILSCALE_IF="tailscale0" # tailscale interface
|
||||
|
||||
# flush rules (avoid dupes)
|
||||
iptables -F
|
||||
iptables -t nat -F
|
||||
iptables -t mangle -F
|
||||
iptables -X
|
||||
|
||||
# set defualt policies
|
||||
iptables -P INPUT DROP
|
||||
iptables -P FORWARD DROP
|
||||
iptables -P OUTPUT ACCEPT
|
||||
|
||||
# allow loopback
|
||||
iptables -A INPUT -i lo -j ACCEPT
|
||||
iptables -A OUTPUT -o lo -j ACCEPT
|
||||
|
||||
# allow replys
|
||||
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
|
||||
iptables -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
|
||||
|
||||
# allow vps outbound
|
||||
iptables -A OUTPUT -o eth0 -j ACCEPT
|
||||
|
||||
# general settings
|
||||
sysctl -w net.ipv4.ip_forward=1 # enable ip forwarding
|
||||
iptables -t nat -A POSTROUTING -o $TAILSCALE_IF -j MASQUERADE # postrouting masquerade (outgoing packets appear to come from vps tailscale ip)
|
||||
iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT # allows pings
|
||||
iptables -A INPUT -p tcp --dport 22 -j ACCEPT # allows ssh
|
||||
|
||||
|
||||
# --- minecraft ---
|
||||
# port: 25777 tcp & udp
|
||||
# prerouting:
|
||||
iptables -t nat -A PREROUTING -i $PUBLIC_IF -p tcp --dport 25777 -j DNAT --to-destination $HOMELAB_IP:25777 # tcp packets on port 25777
|
||||
iptables -t nat -A PREROUTING -i $PUBLIC_IF -p udp --dport 25777 -j DNAT --to-destination $HOMELAB_IP:25777 # udp packets on port 25777
|
||||
# forwards:
|
||||
iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p tcp --dport 25777 -j ACCEPT # vps -> homelab: tcp on port 25777
|
||||
iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p udp --dport 25777 -j ACCEPT # vps -> homelab: udp on port 25777
|
||||
iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p tcp --sport 25777 -j ACCEPT # homelab -> vps: tcp on port 25777
|
||||
iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p udp --sport 25777 -j ACCEPT # homelab -> vps: udp on port 25777
|
||||
|
||||
# --- reverse proxy ---
|
||||
# ports: 80 & 443 tcp
|
||||
# prerouting:
|
||||
iptables -t nat -A PREROUTING -i $PUBLIC_IF -p tcp --dport 80 -j DNAT --to-destination $HOMELAB_IP:80 # tcp packets on port 80
|
||||
iptables -t nat -A PREROUTING -i $PUBLIC_IF -p tcp --dport 443 -j DNAT --to-destination $HOMELAB_IP:443 # tcp packets on port 443
|
||||
# forwards:
|
||||
iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p tcp --dport 80 -j ACCEPT # vps -> homelab: tcp on port 80
|
||||
iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p tcp --sport 80 -j ACCEPT # homelab -> vps: tcp on port 80
|
||||
iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p tcp --dport 443 -j ACCEPT # vps -> homelab: tcp on port 443
|
||||
iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p tcp --sport 443 -j ACCEPT # homelab -> vps: tcp on port 443
|
||||
|
||||
# --- gitea ssh ---
|
||||
# port: 7567 tcp
|
||||
# prerouting:
|
||||
iptables -t nat -A PREROUTING -i $PUBLIC_IF -p tcp --dport 7567 -j DNAT --to-destination $HOMELAB_IP:7567 # tcp packets on port 7567
|
||||
# forwards:
|
||||
iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p tcp --dport 7567 -j ACCEPT # vps -> homelab: tcp on port 7567
|
||||
iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p tcp --sport 7567 -j ACCEPT # homelab -> vps: tcp on port 7567
|
||||
|
||||
# --- rustdesk ---
|
||||
# ports 2114-2119
|
||||
# hbbs ports
|
||||
# 21115 tcp (nat type test)
|
||||
iptables -t nat -A PREROUTING -i $PUBLIC_IF -p tcp --dport 21115 -j DNAT --to-destination $HOMELAB_IP:21115 # tcp packets on port 21115
|
||||
iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p tcp --dport 21115 -j ACCEPT # vps -> homelab: tcp on port 21115
|
||||
iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p tcp --sport 21115 -j ACCEPT # homelab -> vps: tcp on port 21115
|
||||
# 21116 tcp&udp (id registration, heartbeat, TCP hole punching)
|
||||
iptables -t nat -A PREROUTING -i $PUBLIC_IF -p tcp --dport 21116 -j DNAT --to-destination $HOMELAB_IP:21116 # tcp packets on port 21116
|
||||
iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p tcp --dport 21116 -j ACCEPT # vps -> homelab: tcp on port 21116
|
||||
iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p tcp --sport 21116 -j ACCEPT # homelab -> vps: tcp on port 21116
|
||||
iptables -t nat -A PREROUTING -i $PUBLIC_IF -p udp --dport 21116 -j DNAT --to-destination $HOMELAB_IP:21116 # udp packets on port 21116
|
||||
iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p udp --dport 21116 -j ACCEPT # vps -> homelab: tcp on port 21116
|
||||
iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p udp --sport 21116 -j ACCEPT # homelab -> vps: tcp on port 21116
|
||||
# 21118 tcp (web client support)
|
||||
iptables -t nat -A PREROUTING -i $PUBLIC_IF -p tcp --dport 21118 -j DNAT --to-destination $HOMELAB_IP:21118 # tcp packets on port 21118
|
||||
iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p tcp --dport 21118 -j ACCEPT # vps -> homelab: tcp on port 21118
|
||||
iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p tcp --sport 21118 -j ACCEPT # homelab -> vps: tcp on port 21118
|
||||
# hbbr ports
|
||||
# 21117 tcp (relay services)
|
||||
iptables -t nat -A PREROUTING -i $PUBLIC_IF -p tcp --dport 21117 -j DNAT --to-destination $HOMELAB_IP:21117 # tcp packets on port 21117
|
||||
iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p tcp --dport 21117 -j ACCEPT # vps -> homelab: tcp on port 21117
|
||||
iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p tcp --sport 21117 -j ACCEPT # homelab -> vps: tcp on port 21117
|
||||
# 21119 tcp (web client support)
|
||||
iptables -t nat -A PREROUTING -i $PUBLIC_IF -p tcp --dport 21119 -j DNAT --to-destination $HOMELAB_IP:21119 # tcp packets on port 21119
|
||||
iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p tcp --dport 21119 -j ACCEPT # vps -> homelab: tcp on port 21119
|
||||
iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p tcp --sport 21119 -j ACCEPT
|
||||
'';
|
||||
nat = {
|
||||
enable = true;
|
||||
externalInterface = "eth0"; # your PUBLIC_IF
|
||||
internalInterfaces = [ "tailscale0" ];
|
||||
forwardPorts = [
|
||||
{ sourcePort = 80; destination = "10.10.0.10:80"; proto = "tcp"; } # http
|
||||
{ sourcePort = 443; destination = "10.10.0.10:443"; proto = "tcp"; } # https
|
||||
{ sourcePort = 25777; destination = "10.10.0.10:25777"; proto = "tcp"; } # minecraft
|
||||
{ sourcePort = 25777; destination = "10.10.0.10:25777"; proto = "udp"; } # minecraft
|
||||
{ sourcePort = 7567; destination = "10.10.0.10:7567"; proto = "tcp"; } # git
|
||||
|
||||
# Rustdesk ports
|
||||
{ sourcePort = 21115; destination = "10.10.0.10:21115"; proto = "tcp"; }
|
||||
{ sourcePort = 21116; destination = "10.10.0.10:21116"; proto = "tcp"; }
|
||||
{ sourcePort = 21116; destination = "10.10.0.10:21116"; proto = "udp"; }
|
||||
{ sourcePort = 21118; destination = "10.10.0.10:21118"; proto = "tcp"; }
|
||||
{ sourcePort = 21117; destination = "10.10.0.10:21117"; proto = "tcp"; }
|
||||
{ sourcePort = 21119; destination = "10.10.0.10:21119"; proto = "tcp"; }
|
||||
];
|
||||
};
|
||||
|
||||
firewall = {
|
||||
enable = true;
|
||||
allowedTCPPorts = [ 22 80 443 25777 7567 21115 21116 21117 21118 21119 ];
|
||||
allowedUDPPorts = [ 25777 21116 ];
|
||||
# tailscale will also need its UDP port open:
|
||||
allowedUDPPorts = [ config.services.tailscale.port 25777 21116 ];
|
||||
trustedInterfaces = [ "tailscale0" ];
|
||||
};
|
||||
|
||||
|
||||
# Open ports in the firewall, the wrong way
|
||||
# networking.firewall.enable = true;
|
||||
# networking.firewall.extraCommands = ''
|
||||
# HOMELAB_IP="10.10.0.10" # destination address
|
||||
# PUBLIC_IF="eth0" # vps public interface
|
||||
# TAILSCALE_IF="tailscale0" # tailscale interface
|
||||
#
|
||||
# # flush rules (avoid dupes)
|
||||
# iptables -F
|
||||
# iptables -t nat -F
|
||||
# iptables -t mangle -F
|
||||
# iptables -X
|
||||
#
|
||||
# # set defualt policies
|
||||
# iptables -P INPUT DROP
|
||||
# iptables -P FORWARD DROP
|
||||
# iptables -P OUTPUT ACCEPT
|
||||
#
|
||||
# # allow loopback
|
||||
# iptables -A INPUT -i lo -j ACCEPT
|
||||
# iptables -A OUTPUT -o lo -j ACCEPT
|
||||
#
|
||||
# # allow replys
|
||||
# iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
|
||||
# iptables -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
|
||||
#
|
||||
# # allow vps outbound
|
||||
# iptables -A OUTPUT -o eth0 -j ACCEPT
|
||||
#
|
||||
# # general settings
|
||||
# sysctl -w net.ipv4.ip_forward=1 # enable ip forwarding
|
||||
# iptables -t nat -A POSTROUTING -o $TAILSCALE_IF -j MASQUERADE # postrouting masquerade (outgoing packets appear to come from vps tailscale ip)
|
||||
# iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT # allows pings
|
||||
# iptables -A INPUT -p tcp --dport 22 -j ACCEPT # allows ssh
|
||||
#
|
||||
#
|
||||
# # --- minecraft ---
|
||||
# # port: 25777 tcp & udp
|
||||
# # prerouting:
|
||||
# iptables -t nat -A PREROUTING -i $PUBLIC_IF -p tcp --dport 25777 -j DNAT --to-destination $HOMELAB_IP:25777 # tcp packets on port 25777
|
||||
# iptables -t nat -A PREROUTING -i $PUBLIC_IF -p udp --dport 25777 -j DNAT --to-destination $HOMELAB_IP:25777 # udp packets on port 25777
|
||||
# # forwards:
|
||||
# iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p tcp --dport 25777 -j ACCEPT # vps -> homelab: tcp on port 25777
|
||||
# iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p udp --dport 25777 -j ACCEPT # vps -> homelab: udp on port 25777
|
||||
# iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p tcp --sport 25777 -j ACCEPT # homelab -> vps: tcp on port 25777
|
||||
# iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p udp --sport 25777 -j ACCEPT # homelab -> vps: udp on port 25777
|
||||
#
|
||||
# # --- reverse proxy ---
|
||||
# # ports: 80 & 443 tcp
|
||||
# # prerouting:
|
||||
# iptables -t nat -A PREROUTING -i $PUBLIC_IF -p tcp --dport 80 -j DNAT --to-destination $HOMELAB_IP:80 # tcp packets on port 80
|
||||
# iptables -t nat -A PREROUTING -i $PUBLIC_IF -p tcp --dport 443 -j DNAT --to-destination $HOMELAB_IP:443 # tcp packets on port 443
|
||||
# # forwards:
|
||||
# iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p tcp --dport 80 -j ACCEPT # vps -> homelab: tcp on port 80
|
||||
# iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p tcp --sport 80 -j ACCEPT # homelab -> vps: tcp on port 80
|
||||
# iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p tcp --dport 443 -j ACCEPT # vps -> homelab: tcp on port 443
|
||||
# iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p tcp --sport 443 -j ACCEPT # homelab -> vps: tcp on port 443
|
||||
#
|
||||
# # --- gitea ssh ---
|
||||
# # port: 7567 tcp
|
||||
# # prerouting:
|
||||
# iptables -t nat -A PREROUTING -i $PUBLIC_IF -p tcp --dport 7567 -j DNAT --to-destination $HOMELAB_IP:7567 # tcp packets on port 7567
|
||||
# # forwards:
|
||||
# iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p tcp --dport 7567 -j ACCEPT # vps -> homelab: tcp on port 7567
|
||||
# iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p tcp --sport 7567 -j ACCEPT # homelab -> vps: tcp on port 7567
|
||||
#
|
||||
# # --- rustdesk ---
|
||||
# # ports 2114-2119
|
||||
# # hbbs ports
|
||||
# # 21115 tcp (nat type test)
|
||||
# iptables -t nat -A PREROUTING -i $PUBLIC_IF -p tcp --dport 21115 -j DNAT --to-destination $HOMELAB_IP:21115 # tcp packets on port 21115
|
||||
# iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p tcp --dport 21115 -j ACCEPT # vps -> homelab: tcp on port 21115
|
||||
# iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p tcp --sport 21115 -j ACCEPT # homelab -> vps: tcp on port 21115
|
||||
# # 21116 tcp&udp (id registration, heartbeat, TCP hole punching)
|
||||
# iptables -t nat -A PREROUTING -i $PUBLIC_IF -p tcp --dport 21116 -j DNAT --to-destination $HOMELAB_IP:21116 # tcp packets on port 21116
|
||||
# iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p tcp --dport 21116 -j ACCEPT # vps -> homelab: tcp on port 21116
|
||||
# iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p tcp --sport 21116 -j ACCEPT # homelab -> vps: tcp on port 21116
|
||||
# iptables -t nat -A PREROUTING -i $PUBLIC_IF -p udp --dport 21116 -j DNAT --to-destination $HOMELAB_IP:21116 # udp packets on port 21116
|
||||
# iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p udp --dport 21116 -j ACCEPT # vps -> homelab: tcp on port 21116
|
||||
# iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p udp --sport 21116 -j ACCEPT # homelab -> vps: tcp on port 21116
|
||||
# # 21118 tcp (web client support)
|
||||
# iptables -t nat -A PREROUTING -i $PUBLIC_IF -p tcp --dport 21118 -j DNAT --to-destination $HOMELAB_IP:21118 # tcp packets on port 21118
|
||||
# iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p tcp --dport 21118 -j ACCEPT # vps -> homelab: tcp on port 21118
|
||||
# iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p tcp --sport 21118 -j ACCEPT # homelab -> vps: tcp on port 21118
|
||||
# # hbbr ports
|
||||
# # 21117 tcp (relay services)
|
||||
# iptables -t nat -A PREROUTING -i $PUBLIC_IF -p tcp --dport 21117 -j DNAT --to-destination $HOMELAB_IP:21117 # tcp packets on port 21117
|
||||
# iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p tcp --dport 21117 -j ACCEPT # vps -> homelab: tcp on port 21117
|
||||
# iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p tcp --sport 21117 -j ACCEPT # homelab -> vps: tcp on port 21117
|
||||
# # 21119 tcp (web client support)
|
||||
# iptables -t nat -A PREROUTING -i $PUBLIC_IF -p tcp --dport 21119 -j DNAT --to-destination $HOMELAB_IP:21119 # tcp packets on port 21119
|
||||
# iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p tcp --dport 21119 -j ACCEPT # vps -> homelab: tcp on port 21119
|
||||
# iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p tcp --sport 21119 -j ACCEPT
|
||||
# '';
|
||||
#
|
||||
|
||||
system.stateVersion = "25.05"; # Did you read the comment?
|
||||
|
||||
|
||||
Reference in New Issue
Block a user