firewall

common/default.nix

@@ -4,6 +4,7 @@
   imports = [
     ./users.nix
     ./motd.nix
+    ./firewall.nix
   ];
 
   nix = {
@@ -36,7 +37,6 @@
     execWheelOnly = true;
   };
 
-  networking.firewall.enable = false;
   services.openssh = {
     enable = true;
     settings = {

common/firewall.nix

@@ -0,0 +1,26 @@
+{ config, pkgs, ... }:
+
+{
+  networking.firewall.enable = false;
+  networking.nftables = {
+    enable = true;
+    ruleset = ''
+      table inet filter {
+        chain input {
+          type filter hook input priority 0; policy accept;
+        }
+
+        chain forward {
+          type filter hook forward priority 0; policy accept
+        }
+
+        chain output {
+          type filter hook output priority 0; policy accept
+
+          # Block outgoing mail traffic
+          tcp dport {25, 465, 587} drop
+        }
+      }
+    '';
+  };
+}

hosts/jude.nix

@@ -23,7 +23,6 @@
   time.timeZone = "America/Chicago";
   i18n.defaultLocale = "en_US.UTF-8";
   services.openssh.enable = true;
-  networking.firewall.enable = false;
 
   networking = {
     hostName = "jade";

hosts/nova.nix

@@ -23,7 +23,6 @@
   time.timeZone = "Europe/London";
   i18n.defaultLocale = "en_US.UTF-8";
   services.openssh.enable = true;
-  networking.firewall.enable = false;
 
   networking = {
     hostName = "nova";