diff options
| author | Fuwn <[email protected]> | 2024-09-11 00:52:32 -0700 |
|---|---|---|
| committer | Fuwn <[email protected]> | 2024-09-11 00:52:32 -0700 |
| commit | b6956dd32fbe4bd6a83336a66c3ff73ec47c7b9c (patch) | |
| tree | 5e61c8151b6cde865405d61fb9c1f7bd65c9f662 /modules/software/networking/firewall | |
| parent | Bump: swift (diff) | |
| download | nixos-config-b6956dd32fbe4bd6a83336a66c3ff73ec47c7b9c.tar.xz nixos-config-b6956dd32fbe4bd6a83336a66c3ff73ec47c7b9c.zip | |
Bump: i2p
Diffstat (limited to 'modules/software/networking/firewall')
| -rw-r--r-- | modules/software/networking/firewall/default.nix | 11 | ||||
| -rw-r--r-- | modules/software/networking/firewall/fail2ban.nix | 20 |
2 files changed, 31 insertions, 0 deletions
diff --git a/modules/software/networking/firewall/default.nix b/modules/software/networking/firewall/default.nix new file mode 100644 index 0000000..074f398 --- /dev/null +++ b/modules/software/networking/firewall/default.nix @@ -0,0 +1,11 @@ +{ + imports = [ ./fail2ban.nix ]; + + networking.firewall = { + enable = true; + allowPing = false; + logReversePathDrops = true; + logRefusedConnections = false; + checkReversePath = "loose"; + }; +} diff --git a/modules/software/networking/firewall/fail2ban.nix b/modules/software/networking/firewall/fail2ban.nix new file mode 100644 index 0000000..6311b14 --- /dev/null +++ b/modules/software/networking/firewall/fail2ban.nix @@ -0,0 +1,20 @@ +{ pkgs, lib, ... }: +{ + services.fail2ban = { + enable = false; + banaction = "nftables-multiport"; + banaction-allports = lib.mkDefault "nftables-allport"; + + extraPackages = with pkgs; [ + nftables + ipset + ]; + + ignoreIP = [ + "10.0.0.0/8" + "172.16.0.0/12" + "100.64.0.0/16" + "192.168.0.0/16" + ]; + }; +} |