From 6ff99bfec437cf6d53ce590cb4499898bf9d94b5 Mon Sep 17 00:00:00 2001
From: catvayor <catvayor@katvayor.net>
Date: Mon, 9 Sep 2024 21:54:39 +0200
Subject: [PATCH] feat(ISP): firewall to separate users

---
 machines/vault01/networking.nix | 50 ++++-----------------------------
 1 file changed, 6 insertions(+), 44 deletions(-)

diff --git a/machines/vault01/networking.nix b/machines/vault01/networking.nix
index ac913e6..d3126b4 100644
--- a/machines/vault01/networking.nix
+++ b/machines/vault01/networking.nix
@@ -39,7 +39,6 @@ let
   mkUserVlan =
     {
       vlan,
-      netIP,
       servIP,
       interfaceName,
       ...
@@ -48,38 +47,13 @@ let
       name = interfaceName;
       value = {
         Id = vlan;
+        address = with uplink; [ "${servIP}/27" ];
         extraNetwork = {
           networkConfig = {
             LinkLocalAddressing = "no";
             DHCPServer = "yes";
           };
           linkConfig.Promiscuous = true;
-          addresses = [
-            {
-              addressConfig = {
-                Address = "${servIP}/27";
-                AddPrefixRoute = false;
-              };
-            }
-          ];
-          routes = [
-            {
-              routeConfig = {
-                Destination = "${netIP}/27";
-                Table = "user";
-              };
-            }
-          ];
-          routingPolicyRules = [
-            {
-              routingPolicyRuleConfig = {
-                From = "${netIP}/27";
-                To = "10.0.0.0/27";
-                IncomingInterface = interfaceName;
-                Table = "user";
-              };
-            }
-          ];
         };
       };
     };
@@ -140,7 +114,6 @@ in
 {
   systemd = {
     network = {
-      config.routeTables."user" = 1000;
       networks = {
         "10-lo" = {
           name = "lo";
@@ -149,22 +122,6 @@ in
             "127.0.0.1/8"
             "10.0.0.1/27"
           ];
-          routes = [
-            {
-              routeConfig = {
-                Destination = "10.0.0.0/27";
-                Table = "user";
-              };
-            }
-          ];
-          routingPolicyRules = [
-            {
-              routingPolicyRuleConfig = {
-                IncomingInterface = "lo";
-                Table = "user";
-              };
-            }
-          ];
         };
         "10-enp67s0f0np0" = {
           name = "enp67s0f0np0";
@@ -246,6 +203,11 @@ in
     firewall = {
       allowedUDPPorts = [ 67 ];
       checkReversePath = false;
+      filterForward = true;
+      extraForwardRules = ''
+        ip saddr 10.0.0.0/16 ip daddr 10.0.0.0/27 accept
+        ip saddr 10.0.0.0/16 ip daddr != 10.0.0.0/16 accept
+      '';
     };
   };