From a2201eaa979e6e852e0dd519ca5c5dc43ad3b48f Mon Sep 17 00:00:00 2001
From: Mark Nipper <nipsy@bitgnome.net>
Date: Sun, 13 Oct 2024 02:34:01 -0700
Subject: Add initial VPN support @arrakis

---
 hosts/arrakis/default.nix | 58 +++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 58 insertions(+)

(limited to 'hosts/arrakis')

diff --git a/hosts/arrakis/default.nix b/hosts/arrakis/default.nix
index b8aa5e6..1e9641f 100644
--- a/hosts/arrakis/default.nix
+++ b/hosts/arrakis/default.nix
@@ -1,6 +1,10 @@
 { config, pkgs, ... }: {
   boot = {
     initrd.kernelModules = [ "zfs" ];
+    kernel.sysctl = {
+      "net.ipv4.ip_forward" = 1;
+      "net.ipv4.conf.all.proxy_arp" = 1;
+    };
     kernelPackages = pkgs.linuxPackages_6_10;
     loader = {
       efi = {
@@ -18,6 +22,59 @@
     supportedFilesystems = [ "zfs" ];
   };
 
+  environment.etc."nftables-vpn.conf".text = ''
+    # VPN firewall
+    
+    flush ruleset
+    
+    table inet filter {
+    	chain input {
+    		type filter hook input priority filter; policy drop;
+    
+    		# established/related connections
+    		ct state established,related accept
+    
+    		# invalid connections
+    		ct state invalid drop
+    
+    		# loopback interface
+    		iif lo accept
+    
+    		# ICMP (routers may also want: mld-listener-query, nd-router-solicit)
+    		#ip6 nexthdr icmpv6 icmpv6 type { destination-unreachable, echo-reply, echo-request, nd-neighbor-advert, nd-neighbor-solicit, nd-router-advert, packet-too-big, parameter-problem, time-exceeded } accept
+    		ip protocol icmp icmp type { destination-unreachable, echo-reply, echo-request, parameter-problem, router-advertisement, source-quench, time-exceeded } accept
+    
+    		# services
+    		iif veth.vpn tcp dport 8080 accept # qBittorrent
+    		iif veth.vpn tcp dport 9696 accept # Prowlarr
+    		iifname wg1 tcp dport { 49152-65535 } accept # Transmission
+    	}
+    
+    	chain output {
+    		type filter hook output priority filter; policy drop;
+    
+    		# explicitly allow my DNS traffic without VPN
+    		skuid nipsy ip daddr 192.168.1.1 tcp dport domain accept
+    		skuid nipsy ip daddr 192.168.1.1 udp dport domain accept
+    
+    		# explicitly allow my traffic without VPN
+    		oifname veth.vpn skuid nipsy tcp sport 8080 accept # qBittorrent
+    		oifname veth.vpn skuid nipsy tcp sport 9696 accept # Prowlarr
+    		oifname veth.vpn skuid nipsy ip daddr 192.168.1.2 tcp dport { 7878, 8686, 8787, 8989 } accept # Prowlarr to { Radarr, Lidarr, Readarr, Sonarr }
+    
+    		# allow any traffic out through VPN
+    		oifname wg1 accept
+    
+    		# drop everything else
+    		counter drop
+    	}
+    
+    	chain forward {
+    		type filter hook forward priority filter; policy drop;
+    	}
+    }
+  '';
+
   environment.systemPackages = with pkgs; [
     signal-desktop
     wpa_supplicant
@@ -143,6 +200,7 @@
       "wireguard/ramped_psk" = {};
       "wireguard/timetrad_psk" = {};
       "wireguard/treebeard_psk" = {};
+      "wireguard/wg1_conf" = {};
       "wpa_supplicant" = {};
     };
   };
-- 
cgit v1.2.3