From 40f6e567cd1c8bd893d92b40487571847799c647 Mon Sep 17 00:00:00 2001
From: Jakub Stachurski <j.stachurski@student.utwente.nl>
Date: Sat, 3 May 2025 21:49:42 +0200
Subject: firewall

---
 nixos/hosts/apocalypse/firewall.nix | 47 +++++++++++++++++++++++++++++++++++++
 1 file changed, 47 insertions(+)
 create mode 100644 nixos/hosts/apocalypse/firewall.nix

(limited to 'nixos/hosts/apocalypse/firewall.nix')

diff --git a/nixos/hosts/apocalypse/firewall.nix b/nixos/hosts/apocalypse/firewall.nix
new file mode 100644
index 0000000..2068d55
--- /dev/null
+++ b/nixos/hosts/apocalypse/firewall.nix
@@ -0,0 +1,47 @@
+{pkgs, config, ...}:
+let 
+  baseTCP = [
+    
+  ]; 
+  baseUDP = [
+    16555 # Wireguard
+  ]; 
+  baseTCPRanges = [
+    { from = 1714; to = 1764; } # KDE-CONNECT 
+  ];
+  baseUDPRanges = [
+    { from = 1714; to = 1764; } # KDE-CONNECT 
+  ];
+
+  secureTCP = [
+    22 80 433 5900
+  ] ++ baseTCP;  
+  
+  secureUDP = [
+    
+  ] ++ baseUDP;  
+
+  secureTCPRanges = [
+
+  ] ++ baseTCPRanges ; 
+  secureUDPRanges = [
+
+  ] ++ baseUDPRanges; 
+in 
+{
+    networking.firewall {
+        enable = true; 
+        allowedTCPPorts = baseTCP; 
+        allowedUDPPorts = baseUDP; 
+          allowedUDPPortRanges = baseUDPRanges;
+          allowedTCPPortRanges = baseTCPRanges;
+        interfaces = {
+        "wg0" = {
+          allowedTCPPorts = secureTCP; 
+          allowedUDPorts = secureUDP; 
+          allowedUDPPortRanges = secureUDPRanges;
+          allowedTCPPortRanges = secureTCPRanges;
+        };
+    };
+}
+
-- 
cgit v1.3.1