dedicated nftables

shared/commons/forward.nix

@@ -0,0 +1,14 @@
+{ ... }:
+{
+    # Enable packet forwarding and pack logging
+    boot.kernel.sysctl = {
+        # Ipv4 
+        "net.ipv4.conf.all.forwarding" = true;
+        # Ipv6
+        "net.ipv6.conf.all.forwarding" = true;
+
+        # NF
+        "net.netfilter.nf_conntrack_acct" = 1;
+        "net.netfilter.nf_conntrack_log_invalid" = 255;
+    };
+}

shared/commons/mesh.nix

@@ -51,6 +51,7 @@ let
                         "172.19.128.0/17"
                         "fc00:f::/96"
                     ];
+                    endpoint = "${builtins.head (builtins.split "/" peerConfig.ip4)}:${toString (51000 + myId)}";
                     persistentKeepalive = 25;
                 }];
                 # Throw away route created by wireguard
@@ -68,7 +69,7 @@ let
         ${pkgs.iproute2}/bin/ip -6 route replace fc00::${toString myId}:${toString peerConfig.id} dev mesh-${shorten peerName}-${toString peerConfig.zone}-${toString peerConfig.id} scope link
 
         # Return path for mgmt trafic
-        ${if !(lib.elem myPeer mapping.bastion) && (lib.elem peerName mapping.bastion) then ''
+        ${if lib.elem peerName mapping.bastion then ''
             ${pkgs.iproute2}/bin/ip route replace 172.19.${toString (peerConfig.zone + 127)}.0/24 via 172.19.${toString myPeer.id}.${toString peerConfig.id} dev mesh-${shorten peerName}-${toString peerConfig.zone}-${toString peerConfig.id}
             ${pkgs.iproute2}/bin/ip -6 route replace fc00:f::${toString (peerConfig.zone + 127)}:0/96 via fc00::${toString myPeer.id}:${toString peerConfig.id} dev mesh-${shorten peerName}-${toString peerConfig.zone}-${toString peerConfig.id}
         '' else ""}
@@ -107,9 +108,4 @@ in
             ExecStart = "${wireguardStaticRoute}/bin/wireguardStaticRoute";
         };
     };
-
-    # Open UDP port for wireguard traffic
-    networking.firewall.allowedUDPPorts = lib.range 51000 (51000 + builtins.head (
-        builtins.sort (a: b: a > b) (
-        lib.mapAttrsToList (name: node: node.id) nodes)));
 }

shared/commons/networking.nix

@@ -42,5 +42,4 @@ in
             off = 999;
         };
     };
-    networking.firewall.enable = true;
 }

shared/commons/nftables.nix

@@ -0,0 +1,97 @@
+{ lib, ... }:
+
+let
+    # Import nodes
+    nodes = import ./../../nodes.nix;
+    myPeer = nodes."${config.hostName}";
+
+    meshUdpRange = "51000-${toString (51000 + builtins.head (
+        builtins.sort (a: b: a > b) (
+    l   ib.mapAttrsToList (name: node: node.id) nodes)))}";
+in
+{
+    networking = {
+        nat.enable = false;
+        firewall.enable = false;
+        nftables = {
+            enable = true;
+            checkRuleset = true;
+            flushRuleset = true;
+            tables = {
+                filter = {
+                    family = "inet";
+                    content = ''
+                        chain preroute {
+                            type filter hook prerouting priority -150; policy accept;
+                        }
+                        chain input {
+                            type filter hook input priority 0; policy drop;
+
+                            # Authorized already setup connection
+                            ct state related,established accept
+
+                            # Reject sus stuff
+                            ct state invalid counter drop
+                            tcp flags & (fin|syn|rst|ack) != syn ct state new counter drop
+
+                            # Loopback
+                            iif lo accept
+
+                            # ICMP
+                            icmp type { echo-request } limit rate 4/second accept
+                            icmpv6 type { echo-request } limit rate 4/second accept
+                            ip protocol icmp accept
+                            icmpv6 type { nd-neighbor-solicit, nd-router-advert, nd-neighbor-advert } accept
+
+                            # SSH
+                            tcp dport 22 accept
+
+                            # Mesh
+                            udp dport ${meshUdpRange} accept
+
+                            ${if lib.elem myPeer mapping.bastion then ''
+                                # Mgmt
+                                udp dport 51920 accept
+                            '' else ""}
+
+                            # Log anything else
+                            ip protocol tcp counter log prefix "tcp.in.dropped: "
+                            ip protocol udp counter log prefix "udp.in.dropped: "
+
+                        }
+                        chain forward {
+                            type filter hook forward priority 0; policy drop;
+
+                            ct state related,established accept
+                            ct state invalid counter drop
+
+                            iifname mgmt oifname mesh accept
+                        }
+                        chain output {
+                            type filter hook output priority 0; policy accept;
+                        }
+                        chain postroute {
+                            type filter hook postrouting priority 50; policy accept;
+                        }
+                    '';
+                };
+                # We'll not nat the outgoing wg packet
+                # Instead custom routing is done on all
+                # other node to sent it back correclty
+                # That allow for custom ACL for the mgmt
+                # ip addresses
+                nat = {
+                    family = "inet";
+                    content = ''
+                        chain prerouting {
+                            type nat hook prerouting priority -100; policy accept;
+                        }
+                        chain postrouting {
+                            type nat hook postrouting priority 100; policy accept;
+                        }
+                    '';
+                };
+            };
+        };
+    };
+}