privatevoid.net/depot
1
1
Fork 0
Code Issues 23 Pull requests 2 Projects 3 Releases Packages Wiki Activity Actions

hosts/VEGAS: drop all outgoing traffic to private IP addresses

Browse source
This commit is contained in:
Max Headroom 2022-11-17 16:55:21 +01:00
parent 3c8bbf3bde
commit 93b7118de9
1 changed files with 32 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

33
hosts/VEGAS/system.nix
View file

@ -63,7 +63,38 @@
services.openssh.enable = true;
networking.firewall.enable = true;
networking.firewall = {
enable = true;
extraCommands = let
privateIp4Ranges = [
"10.0.0.0/8"
"100.64.0.0/10"
"169.254.0.0/16"
"172.16.0.0/12"
"192.0.0.0/24"
"192.0.2.0/24"
"192.168.0.0/16"
"198.18.0.0/15"
"198.51.100.0/24"
"203.0.113.0/24"
"240.0.0.0/4"
];
privateIp6Ranges = [
"100::/64"
"2001:2::/48"
"2001:db8::/32"
"fc00::/7"
"fe80::/10"
];
mkRules = ipt: ranges: map (x: "${ipt} -I nixos-fw 1 -d ${x} -o ${hosts.${config.networking.hostName}.interfaces.primary.link} -j DROP") ranges;
rules4 = mkRules "iptables" privateIp4Ranges;
rules6 = mkRules "ip6tables" privateIp6Ranges;
in builtins.concatStringsSep "\n" (rules4 ++ rules6);
};
system.stateVersion = "21.05";
services.openssh.passwordAuthentication = false;