Zone-based firewall page, per-sensor temperatures, 15 minute default

The firewall page now manages zones (assign each LAN or tunnel, add and
remove zones) and rules with zone, address and port on both sides plus the
protocol. router.firewall.zones declares zones without members and rules
take sourcePorts. The temperature chart draws every thermal zone and hwmon
sensor; the overview defaults to 15 minutes, 1h stays an option.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AeFqV9dZrK6nipHkPfyM4F

modules/router/assertions.nix

@@ -142,7 +142,7 @@ let
     );
 
   wgs = lib.attrValues cfg.wireguard;
-  zoneNames = lib.unique (map (l: l.zone) lans ++ map (w: w.zone) wgs);
+  zoneNames = lib.unique (map (l: l.zone) lans ++ map (w: w.zone) wgs ++ cfg.firewall.zones);
 
   isV6 = lib.hasInfix ":";
   v4Cidr = s: lib.hasInfix "/" s && ipv4.parseNet s != null;
@@ -227,7 +227,11 @@ let
         message = "router: ${where}: ports are only valid with protocol tcp or udp.";
       }
       {
-        assertion = lib.all portOk r.ports;
+        assertion = r.sourcePorts == [ ] || ((r.protocol == "tcp" || r.protocol == "udp") && !r.dnat);
+        message = "router: ${where}: sourcePorts are only valid with protocol tcp or udp, and not on a port forward.";
+      }
+      {
+        assertion = lib.all portOk (r.ports ++ r.sourcePorts);
         message = "router: ${where}: a port or port range is out of range (1-65535, ranges need low < high).";
       }
       {

modules/router/firewall.nix

@@ -62,15 +62,17 @@ let
 
   setOf = xs: "{ ${lib.concatMapStringsSep ", " toString xs} }";
 
-  # Layer 4 match; `ports` may be ints or "a-b" ranges.
+  # Layer 4 match; `ports` and `sports` may be ints or "a-b" ranges.
   l4 =
-    proto: ports:
+    proto: ports: sports:
     if proto == "any" then
       ""
     else if proto == "icmp" then
       "meta l4proto { icmp, ipv6-icmp } "
     else
-      "${proto} dport ${if ports == [ ] then "1-65535" else setOf ports} ";
+      "${lib.optionalString (sports != [ ]) "${proto} sport ${setOf sports} "}${proto} dport ${
+        if ports == [ ] then "1-65535" else setOf ports
+      } ";
 
   # Destination match, by family of the address.
   daddrOf =
@@ -121,7 +123,7 @@ let
       toDevs = zoneDevices r.to;
       # After DNAT the packet carries the translated port.
       fwdPorts = if r.dnat && r.toPort != null then [ r.toPort ] else r.ports;
-      base = "iifname ${set fromDevs} oifname ${set toDevs} ${daddrOf r}${l4 r.protocol fwdPorts}${lib.optionalString r.dnat "ct status dnat "}";
+      base = "iifname ${set fromDevs} oifname ${set toDevs} ${daddrOf r}${l4 r.protocol fwdPorts r.sourcePorts}${lib.optionalString r.dnat "ct status dnat "}";
       logPrefix = what: ''log prefix "router fwd#${id} ${label} ${what}: " '';
       limitLines =
         v:
@@ -150,19 +152,22 @@ let
       }";
     in
     {
-      forward = lib.concatMap (v: limitLines v ++ acceptLines v) (variantsOf r);
+      # A zone nothing is assigned to yet has no devices; the rule waits for one.
+      forward = lib.optionals (fromDevs != [ ] && toDevs != [ ]) (
+        lib.concatMap (v: limitLines v ++ acceptLines v) (variantsOf r)
+      );
       prerouting =
         lib.optionals r.dnat (
-          map (v: "iifname ${set uplinks} ${v.src}${l4 r.protocol r.ports}${dnatTarget} # ${label}") (
+          map (v: "iifname ${set uplinks} ${v.src}${l4 r.protocol r.ports [ ]}${dnatTarget} # ${label}") (
             variantsOf r
           )
         )
         # NAT loopback: internal clients addressing the router's public address.
         ++
           lib.optional (r.dnat && r.hairpin)
-            "iifname ${set internetIfaces} fib daddr type local ip daddr != ${setOf internalAddrs} ${l4 r.protocol r.ports}${dnatTarget} # hairpin ${label}";
-      hairpinForward = lib.optional (r.dnat && r.hairpin) (
-        "iifname ${set internetIfaces} oifname ${set toDevs} ip daddr ${r.destination} ${l4 r.protocol fwdPorts}ct status dnat accept # hairpin ${label}"
+            "iifname ${set internetIfaces} fib daddr type local ip daddr != ${setOf internalAddrs} ${l4 r.protocol r.ports [ ]}${dnatTarget} # hairpin ${label}";
+      hairpinForward = lib.optional (r.dnat && r.hairpin && toDevs != [ ]) (
+        "iifname ${set internetIfaces} oifname ${set toDevs} ip daddr ${r.destination} ${l4 r.protocol fwdPorts [ ]}ct status dnat accept # hairpin ${label}"
       );
     };
 

modules/router/options.nix

@@ -382,6 +382,17 @@ in
       );
     };
 
+    firewall.zones = mkOption {
+      type = types.listOf types.str;
+      default = [ ];
+      example = [ "guests" ];
+      description = ''
+        Zones to define besides those of the LANs and tunnels (`zone` there
+        assigns them), so rules can name them before anything is assigned. A
+        zone without members matches nothing.
+      '';
+    };
+
     firewall.rules = mkOption {
       default = [ ];
       description = ''
@@ -426,6 +437,12 @@ in
                 public address.
               '';
             };
+            sourcePorts = mkOption {
+              type = types.listOf (types.either types.port (types.strMatching "[0-9]+-[0-9]+"));
+              default = [ ];
+              example = [ 53 ];
+              description = "Source ports or ranges (tcp/udp only); empty means any. Not for port forwards.";
+            };
             destination = mkOption {
               type = types.nullOr types.str;
               default = null;