nixos-config/system/vpn.nix

83 lines
2.8 KiB
Nix
Raw Normal View History

2023-03-09 12:38:53 -03:00
{ pkgs, ... }: {
networking.firewall.enable = false;
services.mullvad-vpn.enable = true;
2023-03-11 18:44:22 -03:00
2023-03-09 12:38:53 -03:00
networking.nftables = {
enable = true;
2023-03-30 13:28:05 -03:00
ruleset = ''
table inet allowAll {
chain allowIncoming {
type filter hook input priority -100; policy accept;
tcp dport 0-10999 ct mark set 0x00000f41 meta mark set 0x6d6f6c65
2023-03-09 12:38:53 -03:00
}
2023-03-30 13:28:05 -03:00
chain allowOutgoing {
type route hook output priority -100; policy accept;
tcp sport 0-10999 ct mark set 0x00000f41 meta mark set 0x6d6f6c65
}
}
2023-03-09 12:38:53 -03:00
2023-03-30 13:28:05 -03:00
######################################
# _ _ #
# __| | ___ ___| | _____ _ __ #
# / _` |/ _ \ / __| |/ / _ \ '__| #
# | (_| | (_) | (__| < __/ | #
# \__,_|\___/ \___|_|\_\___|_| #
# #
######################################
2023-03-11 18:44:22 -03:00
2023-03-30 13:28:05 -03:00
# This gets sent to the vpn so it's safe
2023-03-11 18:44:22 -03:00
2023-03-30 13:28:05 -03:00
table ip nat {
chain DOCKER {
iifname "docker0" counter packets 0 bytes 0 return
}
2023-03-11 18:44:22 -03:00
2023-03-30 13:28:05 -03:00
chain POSTROUTING {
type nat hook postrouting priority srcnat; policy accept;
oifname != "docker0" ip saddr 172.17.0.0/16 counter packets 0 bytes 0 masquerade
}
2023-03-11 18:44:22 -03:00
2023-03-30 13:28:05 -03:00
chain PREROUTING {
type nat hook prerouting priority dstnat; policy accept;
fib daddr type local counter packets 5 bytes 252 jump DOCKER
}
2023-03-11 18:44:22 -03:00
2023-03-30 13:28:05 -03:00
chain OUTPUT {
type nat hook output priority -100; policy accept;
ip daddr != 127.0.0.0/8 fib daddr type local counter packets 0 bytes 0 jump DOCKER
}
}
table ip filter {
chain DOCKER {
}
2023-03-11 18:44:22 -03:00
2023-03-30 13:28:05 -03:00
chain DOCKER-ISOLATION-STAGE-1 {
iifname "docker0" oifname != "docker0" counter packets 0 bytes 0 jump DOCKER-ISOLATION-STAGE-2
counter packets 0 bytes 0 return
}
2023-03-11 18:44:22 -03:00
2023-03-30 13:28:05 -03:00
chain DOCKER-ISOLATION-STAGE-2 {
oifname "docker0" counter packets 0 bytes 0 drop
counter packets 0 bytes 0 return
}
2023-03-11 18:44:22 -03:00
2023-03-30 13:28:05 -03:00
chain FORWARD {
type filter hook forward priority filter; policy accept;
counter packets 0 bytes 0 jump DOCKER-USER
counter packets 0 bytes 0 jump DOCKER-ISOLATION-STAGE-1
oifname "docker0" ct state related,established counter packets 0 bytes 0 accept
oifname "docker0" counter packets 0 bytes 0 jump DOCKER
iifname "docker0" oifname != "docker0" counter packets 0 bytes 0 accept
iifname "docker0" oifname "docker0" counter packets 0 bytes 0 accept
}
2023-03-11 18:44:22 -03:00
2023-03-30 13:28:05 -03:00
chain DOCKER-USER {
counter packets 0 bytes 0 return
}
}
2023-03-11 18:44:22 -03:00
2023-03-30 13:28:05 -03:00
'';
2023-03-09 12:38:53 -03:00
};
}