bucur/modules/services/firewall.nix

{ ... }:
{
  networking.firewall.enable = true;
  networking.firewall.backend = "firewalld";
  networking.nftables.enable = true;

  services.firewalld.enable = true;
  services.firewalld.settings.DefaultZone = "FedoraServer";

  services.firewalld.zones.FedoraServer = {
    target = "%%REJECT%%";
    interfaces = [ "ens3" ];
    forward = true;
    services = [ "http" "https" "ssh" ];
    ports = [
      {
        port = 8443;
        protocol = "tcp";
      }
    ];
    rules = [
      {
        rule = {
          "@family" = "ipv4";
          source = { "@address" = "80.94.92.177"; };
          port = { "@port" = "ssh"; "@protocol" = "tcp"; };
          reject = { "@type" = "icmp-port-unreachable"; };
        };
      }
      {
        rule = {
          "@family" = "ipv4";
          source = { "@address" = "45.148.10.240"; };
          port = { "@port" = "ssh"; "@protocol" = "tcp"; };
          reject = { "@type" = "icmp-port-unreachable"; };
        };
      }
      {
        rule = {
          "@family" = "ipv4";
          source = { "@address" = "193.242.125.233"; };
          port = { "@port" = "ssh"; "@protocol" = "tcp"; };
          reject = { "@type" = "icmp-port-unreachable"; };
        };
      }
      {
        rule = {
          "@family" = "ipv4";
          source = { "@address" = "45.78.198.204"; };
          port = { "@port" = "ssh"; "@protocol" = "tcp"; };
          reject = { "@type" = "icmp-port-unreachable"; };
        };
      }
      {
        rule = {
          "@family" = "ipv4";
          source = { "@address" = "176.120.22.47"; };
          port = { "@port" = "ssh"; "@protocol" = "tcp"; };
          reject = { "@type" = "icmp-port-unreachable"; };
        };
      }
      {
        rule = {
          "@family" = "ipv4";
          source = { "@address" = "91.202.233.33"; };
          port = { "@port" = "ssh"; "@protocol" = "tcp"; };
          reject = { "@type" = "icmp-port-unreachable"; };
        };
      }
      {
        rule = {
          "@family" = "ipv4";
          source = { "@address" = "188.166.24.102"; };
          port = { "@port" = "ssh"; "@protocol" = "tcp"; };
          reject = { "@type" = "icmp-port-unreachable"; };
        };
      }
      {
        rule = {
          "@family" = "ipv4";
          source = { "@address" = "128.1.47.28"; };
          port = { "@port" = "ssh"; "@protocol" = "tcp"; };
          reject = { "@type" = "icmp-port-unreachable"; };
        };
      }
      {
        rule = {
          "@family" = "ipv4";
          source = { "@address" = "188.166.11.218"; };
          port = { "@port" = "ssh"; "@protocol" = "tcp"; };
          reject = { "@type" = "icmp-port-unreachable"; };
        };
      }
      {
        rule = {
          "@family" = "ipv4";
          source = { "@address" = "104.248.91.222"; };
          port = { "@port" = "ssh"; "@protocol" = "tcp"; };
          reject = { "@type" = "icmp-port-unreachable"; };
        };
      }
    ];
  };
}