1 files changed, 53 insertions, 0 deletions
diff --git a/hosts/omega-relay/firewall.nix b/hosts/omega-relay/firewall.nix
new file mode 100644
index 0000000..7b04813
--- /dev/null
+++ b/hosts/omega-relay/firewall.nix
@@ -0,0 +1,53 @@
+{ ... }:
+let
+  baseTCP = [
+    20 22 433
+  ];
+  baseUDP = [
+    16555 # Wireguard
+  ];
+  baseTCPRanges = [
+  ];
+
+  baseUDPRanges = [
+  ];
+
+  secureTCP = [
+  ];
+
+  secureUDP = [
+  ];
+
+  secureTCPRanges = [
+  ];
+
+  secureUDPRanges = [
+  ];
+in
+{
+  networking.nftables.enable = true;
+  networking.firewall = {
+    enable = true;
+    checkReversePath = false;
+    allowedTCPPorts = baseTCP;
+    allowedUDPPorts = baseUDP;
+    allowedUDPPortRanges = baseUDPRanges;
+    allowedTCPPortRanges = baseTCPRanges;
+    interfaces = {
+      "wg-home" = {
+        allowedTCPPorts = secureTCP;
+        allowedUDPPorts = secureUDP;
+        allowedUDPPortRanges = secureUDPRanges;
+        allowedTCPPortRanges = secureTCPRanges;
+      };
+    };
+    trustedInterfaces = [
+      "docker0"
+      "br-*"
+      "veth*"
+      "vnet*"
+      "virbr*"
+    ];
+
+  };
+}