randogoth/bucur
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Replace firewalld with simple NixOS firewall rules

Browse source
This commit is contained in:
randogoth 2026-02-07 19:48:12 +02:00
parent 0c64358f3e
commit f85fc7a0be
1 changed files with 1 additions and 100 deletions
Download patch file Download diff file Expand all files Collapse all files

101
modules/services/firewall.nix
View file

@ -1,104 +1,5 @@
{ ... }:
{
networking.firewall.enable = true;
networking.firewall.backend = "firewalld";
networking.nftables.enable = true;
services.firewalld.enable = true;
services.firewalld.settings.DefaultZone = "FedoraServer";
services.firewalld.zones.FedoraServer = {
target = "%%REJECT%%";
interfaces = [ "ens3" ];
forward = true;
services = [ "http" "https" "ssh" ];
ports = [
{
port = 8443;
protocol = "tcp";
}
];
rules = [
{
rule = {
"@family" = "ipv4";
source = { "@address" = "80.94.92.177"; };
port = { "@port" = "ssh"; "@protocol" = "tcp"; };
reject = { "@type" = "icmp-port-unreachable"; };
};
}
{
rule = {
"@family" = "ipv4";
source = { "@address" = "45.148.10.240"; };
port = { "@port" = "ssh"; "@protocol" = "tcp"; };
reject = { "@type" = "icmp-port-unreachable"; };
};
}
{
rule = {
"@family" = "ipv4";
source = { "@address" = "193.242.125.233"; };
port = { "@port" = "ssh"; "@protocol" = "tcp"; };
reject = { "@type" = "icmp-port-unreachable"; };
};
}
{
rule = {
"@family" = "ipv4";
source = { "@address" = "45.78.198.204"; };
port = { "@port" = "ssh"; "@protocol" = "tcp"; };
reject = { "@type" = "icmp-port-unreachable"; };
};
}
{
rule = {
"@family" = "ipv4";
source = { "@address" = "176.120.22.47"; };
port = { "@port" = "ssh"; "@protocol" = "tcp"; };
reject = { "@type" = "icmp-port-unreachable"; };
};
}
{
rule = {
"@family" = "ipv4";
source = { "@address" = "91.202.233.33"; };
port = { "@port" = "ssh"; "@protocol" = "tcp"; };
reject = { "@type" = "icmp-port-unreachable"; };
};
}
{
rule = {
"@family" = "ipv4";
source = { "@address" = "188.166.24.102"; };
port = { "@port" = "ssh"; "@protocol" = "tcp"; };
reject = { "@type" = "icmp-port-unreachable"; };
};
}
{
rule = {
"@family" = "ipv4";
source = { "@address" = "128.1.47.28"; };
port = { "@port" = "ssh"; "@protocol" = "tcp"; };
reject = { "@type" = "icmp-port-unreachable"; };
};
}
{
rule = {
"@family" = "ipv4";
source = { "@address" = "188.166.11.218"; };
port = { "@port" = "ssh"; "@protocol" = "tcp"; };
reject = { "@type" = "icmp-port-unreachable"; };
};
}
{
rule = {
"@family" = "ipv4";
source = { "@address" = "104.248.91.222"; };
port = { "@port" = "ssh"; "@protocol" = "tcp"; };
reject = { "@type" = "icmp-port-unreachable"; };
};
}
];
};
networking.firewall.allowedTCPPorts = [ 22 80 443 8443 ];
}