This repository has no description
2.3 kB
97 lines
1{ lib, ... }:
2
3{
4 virtualisation.libvirtd.enable = true;
5 security.polkit.enable = true;
6
7 krebs.iptables.tables.filter.INPUT.rules = [
8 {
9 v6 = false;
10 predicate = "-i virbr0 -p udp -m udp --dport 53";
11 target = "ACCEPT";
12 }
13 {
14 v6 = false;
15 predicate = "-i virbr0 -p tcp -m tcp --dport 53";
16 target = "ACCEPT";
17 }
18 {
19 v6 = false;
20 predicate = "-i virbr0 -p udp -m udp --dport 67";
21 target = "ACCEPT";
22 }
23 {
24 v6 = false;
25 predicate = "-i virbr0 -p tcp -m tcp --dport 67";
26 target = "ACCEPT";
27 }
28 ];
29 krebs.iptables.tables.filter.FORWARD.rules = [
30 {
31 v6 = false;
32 predicate = "-d 192.168.122.0/24 -o virbr0 -m conntrack --ctstate RELATED,ESTABLISHED";
33 target = "ACCEPT";
34 }
35 {
36 v6 = false;
37 predicate = "-s 192.168.122.0/24 -i virbr0";
38 target = "ACCEPT";
39 }
40 {
41 v6 = false;
42 predicate = "-i virbr0 -o virbr0";
43 target = "ACCEPT";
44 }
45 {
46 v6 = false;
47 predicate = "-o virbr0";
48 target = "REJECT --reject-with icmp-port-unreachable";
49 }
50 {
51 v6 = false;
52 predicate = "-i virbr0";
53 target = "REJECT --reject-with icmp-port-unreachable";
54 }
55 ];
56 krebs.iptables.tables.filter.OUTPUT.rules = [
57 {
58 v6 = false;
59 predicate = "-o virbr0 -p udp -m udp --dport 68";
60 target = "ACCEPT";
61 }
62 ];
63 krebs.iptables.tables.nat.PREROUTING.rules = lib.mkBefore [
64 {
65 v6 = false;
66 predicate = "-s 192.168.122.0/24";
67 target = "ACCEPT";
68 }
69 ];
70 krebs.iptables.tables.nat.POSTROUTING.rules = [
71 {
72 v6 = false;
73 predicate = "-s 192.168.122.0/24 -d 224.0.0.0/24";
74 target = "RETURN";
75 }
76 {
77 v6 = false;
78 predicate = "-s 192.168.122.0/24 -d 255.255.255.255";
79 target = "RETURN";
80 }
81 {
82 v6 = false;
83 predicate = "-s 192.168.122.0/24 ! -d 192.168.122.0/24";
84 target = "MASQUERADE";
85 }
86 {
87 v6 = false;
88 predicate = "-s 192.168.122.0/24 ! -d 192.168.122.0/24 -p tcp";
89 target = "MASQUERADE --to-ports 1024-65535";
90 }
91 {
92 v6 = false;
93 predicate = "-s 192.168.122.0/24 ! -d 192.168.122.0/24 -p udp";
94 target = "MASQUERADE --to-ports 1024-65535";
95 }
96 ];
97}