1 files changed, 50 insertions, 0 deletions
diff --git a/hosts/apocalypse/firewall.nix b/hosts/apocalypse/firewall.nix
new file mode 100644
index 0000000..5c73966
--- /dev/null
+++ b/hosts/apocalypse/firewall.nix
@@ -0,0 +1,50 @@
+{pkgs, config, ...}:
+let 
+  baseTCP = [
+    22000 # Syncthng
+  ]; 
+  baseUDP = [
+    22000 # Syncthing
+    22027 # Syncthing 
+    16555 # Wireguard
+  ]; 
+  baseTCPRanges = [
+    { from = 1714; to = 1764; } # KDE-CONNECT 
+  ];
+  baseUDPRanges = [
+    { from = 1714; to = 1764; } # KDE-CONNECT 
+  ];
+
+  secureTCP = [
+    22 80 433 5900 # SSH HTTP VNC
+  ];  
+  
+  secureUDP = [
+    5900 
+  ];  
+
+  secureTCPRanges = [
+
+  ]; 
+  secureUDPRanges = [
+
+  ]; 
+in 
+{
+    networking.firewall = {
+        enable = false; 
+        allowedTCPPorts = baseTCP; 
+        allowedUDPPorts = baseUDP; 
+          allowedUDPPortRanges = baseUDPRanges;
+          allowedTCPPortRanges = baseTCPRanges;
+        interfaces = {
+          "nix-laptop" = {
+            allowedTCPPorts = secureTCP; 
+            allowedUDPPorts = secureUDP; 
+            allowedUDPPortRanges = secureUDPRanges;
+            allowedTCPPortRanges = secureTCPRanges;
+          };
+       };
+    };
+}
+