renken/shione
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

nftables: allow syncthing access over vpn

Browse source 
GUI is also accessible over VPN. However, it will be replaced by
sync.shione.net later on routed through nginx.
This commit is contained in:
Renken 2024-07-30 20:55:43 +02:00
parent ffbf97ac30
commit 190194593f
Signed by: renken
GPG key ID: 1F2BB159B645E575
1 changed files with 23 additions and 15 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

38
config/shione/nftables/files/etc/nftables.conf
View file

@ -1,6 +1,6 @@
#!/usr/sbin/nft -f #!/usr/sbin/nft -f
flush ruleset flush ruleset
define eth_iface = enp1s0 define eth_iface = enp1s0
define wg_iface = wg0 define wg_iface = wg0
@ -9,19 +9,21 @@ define dns_port = 53
define srt_input_udp_port = 60001 define srt_input_udp_port = 60001
define srt_output_port = 60000 define srt_output_port = 60000
define srb2kart_port = 5029 define srb2kart_port = 5029
define syncthing_port = 22000
define syncthing_gui_port = 8384
table inet filter { table inet filter {
chain input_ipv4 { chain input_ipv4 {
# accepting ping (icmp-echo-request) for diagnostic purposes. # accepting ping (icmp-echo-request) for diagnostic purposes.
# However, it also lets probes discover this host is alive. # However, it also lets probes discover this host is alive.
# This sample accepts them within a certain rate limit: # This sample accepts them within a certain rate limit:
icmp type echo-request limit rate 5/second accept icmp type echo-request limit rate 5/second accept
} }
chain input_ipv6 { chain input_ipv6 {
# accept neighbour discovery otherwise connectivity breaks # accept neighbour discovery otherwise connectivity breaks
icmpv6 type { nd-neighbor-solicit, nd-router-advert, nd-neighbor-advert } accept icmpv6 type { nd-neighbor-solicit, nd-router-advert, nd-neighbor-advert } accept
# accepting ping (icmpv6-echo-request) for diagnostic purposes. # accepting ping (icmpv6-echo-request) for diagnostic purposes.
# However, it also lets probes discover this host is alive. # However, it also lets probes discover this host is alive.
# This sample accepts them within a certain rate limit: # This sample accepts them within a certain rate limit:
@ -40,20 +42,26 @@ table inet filter {
# ip saddr 10.8.0.0/32 # ip saddr 10.8.0.0/32
# Allow VPN to use DNS. # Allow VPN to use DNS.
tcp dport { $dns_port } accept tcp dport {
$dns_port
$syncthing_port,
$syncthing_gui_port,
} accept
udp dport { udp dport {
$dns_port, $dns_port,
$srt_input_udp_port, $srt_input_udp_port,
$syncthing_port,
} accept } accept
} }
chain input { chain input {
# By default, drop all traffic unless it meets a filter # By default, drop all traffic unless it meets a filter
# criteria specified by the rules that follow below. # criteria specified by the rules that follow below.
type filter hook input priority 0; policy drop; type filter hook input priority 0; policy drop;
# Allow traffic from established and related packets, drop invalid # Allow traffic from established and related packets, drop invalid
ct state vmap { established : accept, related : accept, invalid : drop } ct state vmap { established : accept, related : accept, invalid : drop }
# Jump to chain according to layer 3 protocol using a verdict map # Jump to chain according to layer 3 protocol using a verdict map
meta protocol vmap { ip : jump input_ipv4, ip6 : jump input_ipv6 } meta protocol vmap { ip : jump input_ipv4, ip6 : jump input_ipv6 }
@ -78,10 +86,10 @@ table inet filter {
# Reject with polite "port unreachable" icmp response # Reject with polite "port unreachable" icmp response
reject reject
} }
chain forward { chain forward {
# Drop everything (assumes this device is not a router) # Drop everything (assumes this device is not a router)
# type filter hook forward priority filter; # type filter hook forward priority filter;
type filter hook forward priority 0; policy drop; type filter hook forward priority 0; policy drop;
@ -89,7 +97,7 @@ table inet filter {
meta l4proto { icmp, ipv6-icmp } accept meta l4proto { icmp, ipv6-icmp } accept
# Allow traffic from established and related packets, drop invalid # Allow traffic from established and related packets, drop invalid
ct state vmap { established : accept, related : accept, invalid : drop } ct state vmap { established : accept, related : accept, invalid : drop }
# Forward traffic within the VPN and between it and the outside world. # Forward traffic within the VPN and between it and the outside world.
iifname $wg_iface oifname $wg_iface counter accept; iifname $wg_iface oifname $wg_iface counter accept;
@ -98,7 +106,7 @@ table inet filter {
# Reject with polite "host unreachable" icmp response # Reject with polite "host unreachable" icmp response
reject with icmpx type host-unreachable reject with icmpx type host-unreachable
} }
chain prerouting { chain prerouting {
type nat hook prerouting priority 0; type nat hook prerouting priority 0;
@ -109,6 +117,6 @@ table inet filter {
# Masquerade all packets from WireGuard VPN to the outside world. # Masquerade all packets from WireGuard VPN to the outside world.
iifname $wg_iface oifname $eth_iface masquerade iifname $wg_iface oifname $eth_iface masquerade
} }
# no need to define output chain, default policy is accept if undefined. # no need to define output chain, default policy is accept if undefined.
} }