dedicated nftables

shared/bastion.nix

@@ -3,7 +3,5 @@
     # Import dependencies
     imports = [
         ./bastion/wireguard.nix
-        ./bastion/forward.nix
-        ./bastion/nftables.nix
     ];
 }

shared/bastion/wireguard.nix

@@ -42,14 +42,6 @@ in
 {
     age.secrets = buildSecret myZone;
 
-    # Networkd backend introduce in 25.05
-    # No independant target are generated 
-    # when using networkd as a backend
-    # If custom systemd ordering is needed 
-    # between wg interface and the rest of 
-    # networking: switch to false here
-    networking.wireguard.useNetworkd = true;
-
     # Return all WireGuard interfaces for each node
     networking.wireguard.interfaces = interface;
 }

shared/commons.nix

@@ -8,5 +8,7 @@
         ./commons/sudo.nix
         ./commons/networking.nix
         ./commons/mesh.nix
+        ./commons/forward.nix
+        ./commons/nftables.nix
     ];
 }

shared/commons/mesh.nix

@@ -51,6 +51,7 @@ let
                         "172.19.128.0/17"
                         "fc00:f::/96"
                     ];
+                    endpoint = "${builtins.head (builtins.split "/" peerConfig.ip4)}:${toString (51000 + myId)}";
                     persistentKeepalive = 25;
                 }];
                 # Throw away route created by wireguard
@@ -68,7 +69,7 @@ let
         ${pkgs.iproute2}/bin/ip -6 route replace fc00::${toString myId}:${toString peerConfig.id} dev mesh-${shorten peerName}-${toString peerConfig.zone}-${toString peerConfig.id} scope link
 
         # Return path for mgmt trafic
-        ${if !(lib.elem myPeer mapping.bastion) && (lib.elem peerName mapping.bastion) then ''
+        ${if lib.elem peerName mapping.bastion then ''
             ${pkgs.iproute2}/bin/ip route replace 172.19.${toString (peerConfig.zone + 127)}.0/24 via 172.19.${toString myPeer.id}.${toString peerConfig.id} dev mesh-${shorten peerName}-${toString peerConfig.zone}-${toString peerConfig.id}
             ${pkgs.iproute2}/bin/ip -6 route replace fc00:f::${toString (peerConfig.zone + 127)}:0/96 via fc00::${toString myPeer.id}:${toString peerConfig.id} dev mesh-${shorten peerName}-${toString peerConfig.zone}-${toString peerConfig.id}
         '' else ""}
@@ -107,9 +108,4 @@ in
             ExecStart = "${wireguardStaticRoute}/bin/wireguardStaticRoute";
         };
     };
-
-    # Open UDP port for wireguard traffic
-    networking.firewall.allowedUDPPorts = lib.range 51000 (51000 + builtins.head (
-        builtins.sort (a: b: a > b) (
-        lib.mapAttrsToList (name: node: node.id) nodes)));
 }

shared/commons/networking.nix

@@ -42,5 +42,4 @@ in
             off = 999;
         };
     };
-    networking.firewall.enable = true;
 }

shared/commons/nftables.nix

@@ -1,9 +1,18 @@
 { lib, ... }:
 
+let
+    # Import nodes
+    nodes = import ./../../nodes.nix;
+    myPeer = nodes."${config.hostName}";
+
+    meshUdpRange = "51000-${toString (51000 + builtins.head (
+        builtins.sort (a: b: a > b) (
+    l   ib.mapAttrsToList (name: node: node.id) nodes)))}";
+in
 {
     networking = {
         nat.enable = false;
-        firewall.enable = lib.mkForce false;
+        firewall.enable = false;
         nftables = {
             enable = true;
             checkRuleset = true;
@@ -38,10 +47,12 @@
                             tcp dport 22 accept
 
                             # Mesh
-                            udp dport 51820 accept
+                            udp dport ${meshUdpRange} accept
 
-                            # Mgmt
-                            udp dport 51920 accept
+                            ${if lib.elem myPeer mapping.bastion then ''
+                                # Mgmt
+                                udp dport 51920 accept
+                            '' else ""}
 
                             # Log anything else
                             ip protocol tcp counter log prefix "tcp.in.dropped: "