feat(nftables): update to new nftables firewall branch

flake.lock

@@ -845,15 +845,16 @@
         ]
       },
       "locked": {
-        "lastModified": 1695065444,
+        "lastModified": 1694993757,
-        "narHash": "sha256-c39mzyE1Z95bOjNfcCpENdQUn8lgTQFXNDeDguZnKs4=",
+        "narHash": "sha256-aXjkz/3rSuJ78Ry0ekzcTrdwvdgJwFyblOSL/PdgbUo=",
         "owner": "thelegy",
         "repo": "nixos-nftables-firewall",
-        "rev": "f1d43094940379f8aa3b7ef750b48db48b622584",
+        "rev": "0680e272f389a8101f87dd82be0a8132c8eabddf",
         "type": "github"
       },
       "original": {
         "owner": "thelegy",
+        "ref": "opt-in-rules",
         "repo": "nixos-nftables-firewall",
         "type": "github"
       }

flake.nix

@@ -56,7 +56,7 @@
     };
 
     nixos-nftables-firewall = {
-      url = "github:thelegy/nixos-nftables-firewall";
+      url = "github:thelegy/nixos-nftables-firewall/opt-in-rules";
       inputs.nixpkgs.follows = "nixpkgs";
     };
 

hosts/kroma/net.nix

@@ -1,8 +1,4 @@
-{
+{config, ...}: {
-  config,
-  lib,
-  ...
-}: {
   networking = {
     inherit (config.repo.secrets.local.networking) hostId;
     wireless.iwd.enable = true;
@@ -37,8 +33,6 @@
   };
 
   networking.nftables.firewall = {
-    zones = lib.mkForce {
+    zones.untrusted.interfaces = ["lan1" "wlan1"];
-      untrusted.interfaces = ["lan1" "wlan1"];
-    };
   };
 }

hosts/nom/net.nix

@@ -1,8 +1,4 @@
-{
+{config, ...}: {
-  config,
-  lib,
-  ...
-}: {
   networking = {
     inherit (config.repo.secrets.local.networking) hostId;
     wireless.iwd.enable = true;
@@ -37,8 +33,6 @@
   };
 
   networking.nftables.firewall = {
-    zones = lib.mkForce {
+    zones.untrusted.interfaces = ["lan1" "wlan1"];
-      untrusted.interfaces = ["lan1" "wlan1"];
-    };
   };
 }

hosts/sentinel/net.nix

@@ -1,8 +1,4 @@
-{
+{config, ...}: {
-  config,
-  lib,
-  ...
-}: {
   networking.hostId = config.repo.secrets.local.networking.hostId;
   networking.domain = config.repo.secrets.local.personalDomain;
 
@@ -35,21 +31,18 @@
     };
   };
 
-  # TODO mkForce nftables
   networking.nftables.firewall = {
-    zones = lib.mkForce {
+    zones = {
       untrusted.interfaces = ["wan"];
       proxy-sentinel.interfaces = ["proxy-sentinel"];
     };
-    rules = lib.mkForce {
     # Allow accessing nginx through the proxy
-      proxy-sentinel-to-local = {
+    rules.proxy-sentinel-to-local = {
       from = ["proxy-sentinel"];
       to = ["local"];
       allowedTCPPorts = [80 443];
     };
   };
-  };
 
   meta.wireguard.proxy-sentinel.server = {
     host = config.networking.fqdn;

hosts/ward/net.nix

@@ -95,19 +95,15 @@ in {
     };
   };
 
-  # TODO mkForce nftables
   networking.nftables.firewall = {
-    zones = lib.mkForce {
+    snippets.nnf-icmp.ipv6Types = ["mld-listener-query" "nd-router-solicit"];
+
+    zones = {
       untrusted.interfaces = ["wan"];
       lan.interfaces = ["lan-self"];
     };
 
-    rules = lib.mkForce {
+    rules = {
-      icmp = {
-        # accept ipv6 router solicit and multicast listener discovery query
-        extraLines = ["ip6 nexthdr icmpv6 icmpv6 type { mld-listener-query, nd-router-solicit } accept"];
-      };
-
       masquerade = {
         from = ["lan"];
         to = ["untrusted"];

hosts/zackbiene/net.nix

@@ -46,10 +46,7 @@ in {
     };
   };
 
-  # TODO mkForce nftables
   networking.nftables.firewall = {
-    zones = lib.mkForce {
+    zones.untrusted.interfaces = ["lan1"];
-      untrusted.interfaces = ["lan1"];
-    };
   };
 }

modules/config/nftables.nix

@@ -27,34 +27,20 @@
 
     firewall = {
       enable = true;
-
+      localZoneName = "local";
-      # TODO mkForce nftables
+      snippets = {
-      zones = lib.mkForce {
+        nnf-conntrack.enable = true;
-        local.localZone = true;
+        nnf-drop.enable = true;
+        nnf-loopback.enable = true;
+        nnf-ssh.enable = true;
+        nnf-icmp = {
+          enable = true;
+          ipv6Types = ["echo-request" "destination-unreachable" "packet-too-big" "time-exceeded" "parameter-problem" "nd-router-advert" "nd-neighbor-solicit" "nd-neighbor-advert"];
+          ipv4Types = ["echo-request" "destination-unreachable" "router-advertisement" "time-exceeded" "parameter-problem"];
+        };
       };
 
-      rules = lib.mkForce {
+      rules.untrusted-to-local = {
-        icmp = {
-          early = true;
-          after = ["ct"];
-          from = "all";
-          to = ["local"];
-          extraLines = [
-            "ip6 nexthdr icmpv6 icmpv6 type { echo-request, destination-unreachable, packet-too-big, time-exceeded, parameter-problem, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert } accept"
-            "ip protocol icmp icmp type { echo-request, destination-unreachable, router-advertisement, time-exceeded, parameter-problem } accept"
-            #"ip6 saddr fe80::/10 ip6 daddr fe80::/10 udp dport 546 accept" # (dhcpv6)
-          ];
-        };
-
-        ssh = {
-          early = true;
-          after = ["ct"];
-          from = "all";
-          to = ["local"];
-          allowedTCPPorts = config.services.openssh.ports;
-        };
-
-        untrusted-to-local = {
         from = ["untrusted"];
         to = ["local"];
 
@@ -66,5 +52,4 @@
       };
     };
   };
-  };
 }

modules/config/resolved.nix

@@ -60,17 +60,11 @@
     );
   in
     lib.mkIf (mdnsInterfaces != []) {
-      # TODO mkForce nftables
+      zones.mdns.interfaces = mdnsInterfaces;
-      zones = lib.mkForce {
+      rules.mdns-to-local = {
-        mdns.interfaces = mdnsInterfaces;
-      };
-
-      rules = lib.mkForce {
-        mdns-to-local = {
         from = ["mdns"];
         to = ["local"];
         allowedUDPPorts = [5353];
       };
     };
-    };
 }

modules/meta/microvms.nix

@@ -190,11 +190,8 @@
             };
           };
 
-        # TODO mkForce nftables
         networking.nftables.firewall = {
-          zones = mkForce {
+          zones.untrusted.interfaces = [vmCfg.networking.mainLinkName];
-            untrusted.interfaces = [vmCfg.networking.mainLinkName];
-          };
         };
 
         meta.wireguard = mkIf vmCfg.localWireguard {

modules/meta/wireguard.nix

@@ -20,7 +20,6 @@
     mapAttrsToList
     mdDoc
     mergeToplevelConfigs
-    mkForce
     mkIf
     mkOption
     net
@@ -134,11 +133,9 @@
       [wgCfg.server.port];
 
     # Open the port in the given nftables rule if specified
-    # TODO mkForce nftables
+    networking.nftables.firewall.rules =
-    networking.nftables.firewall.rules = mkForce (
       optionalAttrs (isServer && wgCfg.server.openFirewallRules != [])
-      (genAttrs wgCfg.server.openFirewallRules (_: {allowedUDPPorts = [wgCfg.server.port];}))
+      (genAttrs wgCfg.server.openFirewallRules (_: {allowedUDPPorts = [wgCfg.server.port];}));
-    );
 
     age.secrets =
       concatAttrs (map