JakeHillion/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

firewall.nix: Allow specifying trusted network interfaces

Browse Source 
Trusted network interfaces (such as "lo") will accept any incoming
traffic.
This commit is contained in:
Eelco Dolstra 2012-09-20 17:51:44 -04:00
parent 1e666c10fa
commit d4af6edd5e
1 changed files with 15 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
modules/services/networking/firewall.nix
View File

@ -98,6 +98,15 @@ in
'';
};
networking.firewall.trustedInterfaces = mkOption {
type = types.list types.string;
description =
''
Traffic coming in from these interfaces will be accepted
unconditionally.
'';
};
networking.firewall.allowedTCPPorts = mkOption {
default = [];
example = [ 22 80 ];
@ -155,6 +164,8 @@ in
# holds).
config = mkIf cfg.enable {
networking.firewall.trustedInterfaces = [ "lo" ];
environment.systemPackages = [ pkgs.iptables ];
boot.kernelModules = [ "nf_conntrack_ftp" ];
@ -222,8 +233,10 @@ in
# The "nixos-fw" chain does the actual work.
ip46tables -N nixos-fw
# Accept all traffic on the loopback interface.
ip46tables -A nixos-fw -i lo -j nixos-fw-accept
# Accept all traffic on the trusted interfaces.
${flip concatMapStrings cfg.trustedInterfaces (iface: ''
ip46tables -A nixos-fw -i ${iface} -j nixos-fw-accept
'')}
# Accept packets from established or related connections.
ip46tables -A nixos-fw -m conntrack --ctstate ESTABLISHED,RELATED -j nixos-fw-accept