From 2144d31a0455ba32a7a0b655afdef33632a8724d Mon Sep 17 00:00:00 2001 From: Karan Jayachandra Date: Fri, 31 Jul 2026 21:12:16 +0200 Subject: Hardened the server by blocking port 53 and added a deploy script --- modules/common.nix | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) (limited to 'modules/common.nix') diff --git a/modules/common.nix b/modules/common.nix index e27d276..7f46af8 100644 --- a/modules/common.nix +++ b/modules/common.nix @@ -15,14 +15,19 @@ }; }; - # Firewall: SSH, HTTP/HTTPS (Caddy), plain DNS, and AdGuard's own - # DNS-over-TLS (853) + DNS-over-HTTPS (8443) listeners. + # Firewall: SSH, HTTP/HTTPS (Caddy), and AdGuard's own DNS-over-TLS (853) + + # DNS-over-HTTPS (8443) listeners. + # Plain DNS (port 53) is deliberately NOT opened: CERT-Bund/BSI flagged this + # host as an open DNS resolver abusable for UDP reflection/amplification + # DDoS (spoofed source IP, no handshake). AdGuard's plain listener is + # disabled entirely in modules/adguard.nix (dns.port = 0) - all clients use + # DoT/DoH instead, which require a real TLS handshake with the real client + # IP and so aren't spoofable the same way. # Port 3000 (AdGuard's plain-HTTP web UI) is deliberately NOT opened here - # see modules/adguard.nix for why it still binds 0.0.0.0 anyway. networking.firewall = { enable = true; - allowedTCPPorts = [ 22 80 443 53 853 8443 ]; - allowedUDPPorts = [ 53 ]; + allowedTCPPorts = [ 22 80 443 853 8443 ]; }; # Nix settings: flakes, auto-gc, auto-optimise -- cgit v1.3.1