Firewall - Revision history

Quasigod: /* Temporary firewall rules */ Remove statement that nixos-firewall-tool only works with iptables

2026-02-27T23:39:00Z

Temporary firewall rules: Remove statement that nixos-firewall-tool only works with iptables

← Older revision		Revision as of 23:39, 27 February 2026
Line 68:		Line 68:
	=== Temporary firewall rules ===		=== Temporary firewall rules ===

	~~If using iptables, for~~ temporary changes to the firewall rules, you can install the [https://search.nixos.org/packages?query=nixos-firewall-tool <code>nixos-firewall-tool</code>] package, which is a [https://github.com/NixOS/nixpkgs/blob/7eee17a8a5868ecf596bbb8c8beb527253ea8f4d/pkgs/by-name/ni/nixos-firewall-tool/nixos-firewall-tool.sh thin wrapper] around <code>iptables</code>.		For temporary changes to the firewall rules, you can install the [https://search.nixos.org/packages?query=nixos-firewall-tool <code>nixos-firewall-tool</code>] package, which is a [https://github.com/NixOS/nixpkgs/blob/7eee17a8a5868ecf596bbb8c8beb527253ea8f4d/pkgs/by-name/ni/nixos-firewall-tool/nixos-firewall-tool.sh thin wrapper] around <code>iptables</code> and <code>nftables</code>.

	[[Category:Server]]		[[Category:Server]]
	[[Category:Applications]]		[[Category:Applications]]

Kacper: Fix a typo that I missed on the preview.

2025-11-26T21:54:29Z

Fix a typo that I missed on the preview.

← Older revision		Revision as of 21:54, 26 November 2025
Line 58:		Line 58:
	</nowiki>}}		</nowiki>}}

	This will add the two specified rules to the <code>input-allow</code> chain in the <code>nixos-fw</code> table. You should of, ~~course~~ replace, the port and subnets with your own.		This will add the two specified rules to the <code>input-allow</code> chain in the <code>nixos-fw</code> table. You should, of course, replace the port and subnets with your own.

	== Tips and tricks ==		== Tips and tricks ==

Kacper: Add a section on how to configure the nftables firewall with more fine-grained rules than just 'allowed ports'.

2025-11-26T21:53:28Z

Add a section on how to configure the nftables firewall with more fine-grained rules than just 'allowed ports'.

← Older revision		Revision as of 21:53, 26 November 2025
Line 43:		Line 43:

	In this case, ports <code>80</code> and <code>443</code> will be allowed for the interface <code>eth0</code>.		In this case, ports <code>80</code> and <code>443</code> will be allowed for the interface <code>eth0</code>.

			=== Advanced Configuration ===
			Some users may want more fine-grained control of how their firewall is configured. This can, when using nftables, be achieved by defining custom tables and chains through {{Nixos:option\|networking.nftables.tables}}.

			It is important to say that a <code>nixos-fw</code> table with multiple chains will be generated by setting {{Nixos:option\|networking.nftables.enable}} to true. These chains can be modified with extra rules through various options within {{Nixos:option\|networking.firewall}}. If possible, try to stick to these when customizing generated rules, as trying to dynamically delete and overwrite them at activation time can be ''very'' error-prone.

			For instance, to expose a TCP port only to your local IPv4 and IPv6 subnets, add the following to your configuration:

			{{file\|/etc/nixos/configuration.nix\|nix\|<nowiki>
			networking.firewall.extraInputRules = ''
			ip saddr 130.236.254.0/24 tcp dport 6600 accept
			ip6 saddr 2001:6b0:17:f0a0::/64 tcp dport 6600 accept
			'';
			</nowiki>}}

			This will add the two specified rules to the <code>input-allow</code> chain in the <code>nixos-fw</code> table. You should of, course replace, the port and subnets with your own.

	== Tips and tricks ==		== Tips and tricks ==

X10an14: Add tip on how to log dropped/rejected network packets

2025-10-08T20:41:23Z

Add tip on how to log dropped/rejected network packets

← Older revision		Revision as of 20:41, 8 October 2025
Line 45:		Line 45:

	== Tips and tricks ==		== Tips and tricks ==

			=== Log all dropped/rejected network packets ===

			On a vanilla NixOS install, the [https://search.nixos.org/options?show=networking.firewall.logRefusedPackets&query=networking.firewall.logRefusedPackets <code>networking.firewall.logRefusedPackets = true;</code>] stanza lets you see lines in syslog with the prefix <code>refused packet:</code>, once you <code>sudo nixos-rebuild switch</code> and then <code>sudo dmesg --follow --human \| grep 'refused packet:'</code>.

	=== Temporary firewall rules ===		=== Temporary firewall rules ===

Pigs: Reword and refactor layout

2025-06-13T17:48:17Z

Reword and refactor layout

← Older revision		Revision as of 17:48, 13 June 2025
Line 1:		Line 1:
	NixOS ~~provides~~ an ~~interface to configure the firewall through the option <code>networking.firewall</code>.~~		[[NixOS]] includes an integrated firewall based on [https://www.netfilter.org/ iptables]/[https://www.nftables.org/ nftables], which can be configured declaratively through the [[NixOS system configuration]]. By default, the firewall is enabled and restricts incoming network connections, allowing users to explicitly define which ports and services should be accessible.

	~~The default~~ firewall ~~uses~~ [https://www.netfilter.org/ iptables]~~. To use the newer~~ [https://www.nftables.org/ nftables] ~~instead~~, ~~additionally set <code>networking~~.~~nftables~~.~~enable = true;</code>~~

	== Enable ==		== Enable ==

	The firewall is enabled ~~when not set~~. To explicitly ~~enable~~ it add the following ~~into~~ your system configuration:		The firewall is enabled by default on NixOS. To explicitly ensure it is enabled, add the following option to your system configuration:

	{{file\|/etc/nixos/configuration.nix\|nix\|<nowiki>		{{file\|/etc/nixos/configuration.nix\|nix\|<nowiki>
	networking.firewall.enable = true;		networking.firewall.enable = true;
	</nowiki>}}		</nowiki>}}

	~~This will make~~ all local ports and services unreachable from external connections.		With the firewall enabled, all local ports and services will be unreachable from external connections unless explicitly allowed.

			To use the newer nftables backend instead of iptables, set the option {{nixos:option\|networking.nftables.enable}} to true.

	== Configuration ==		== Configuration ==
Line 17:		Line 17:
	To allow specific TCP/UDP ports or port ranges on all interfaces, use following syntax:		To allow specific TCP/UDP ports or port ranges on all interfaces, use following syntax:

	<~~syntaxhighlight lang="nix~~>		{{file\|/etc/nixos/configuration.nix\|nix\|<nowiki>
	networking.firewall = {		networking.firewall = {
	enable = true;		enable = true;
	allowedTCPPorts = [ 80 443 ];		allowedTCPPorts = [ 80 443 ];
	allowedUDPPortRanges = [		allowedUDPPortRanges = [
	{ from = 4000; to = 4007; }		{ from = 4000; to = 4007; }
	{ from = 8000; to = 8010; }		{ from = 8000; to = 8010; }
	];		];
	};		};
	</~~syntaxhighlight~~>		</nowiki>}}

			Refer to {{nixos:option\|networking.firewall}} for more firewall module options.

	{{note\|Many services also provide an option to open the required firewall ports automatically. For example, the media server Jellyfin offers the option <code><nowiki>services.jellyfin.openFirewall = true;</nowiki></code> which will open the required TCP ports.}}		{{note\|Many services also provide an option to open the required firewall ports automatically. For example, the media server Jellyfin offers the option <code><nowiki>services.jellyfin.openFirewall = true;</nowiki></code> which will open the required TCP ports.}}

	~~Interface-specific firewall~~ rules ~~can~~ be ~~applied like this~~:		{{warning\|Firewall rules may be overwritten by [[Docker]], as per https://github.com/NixOS/nixpkgs/issues/111852}}

	~~<syntaxhighlight lang~~="nix>		=== Interface specific rules ===
	networking.firewall.interfaces."eth0".allowedTCPPorts = [ 80 443 ];
	</~~syntaxhighlight~~>		It is possible to define firewall rules for specific network interfaces. This can be useful for allowing different ports or services on different network connections. Add the following to your system configuration:

			{{file\|/etc/nixos/configuration.nix\|nix\|<nowiki>
			networking.firewall.interfaces."eth0".allowedTCPPorts = [ 80 443 ];
			</nowiki>}}

	In this case, ports <code>80</code> and <code>443</code> will be allowed for the interface <code>eth0</code>.		In this case, ports <code>80</code> and <code>443</code> will be allowed for the interface <code>eth0</code>.

	~~If using iptables, for temporary changes to the firewall rules, you can install the [https://search.nixos.org/packages?query~~=nixos-firewall-tool <code>nixos-firewall-tool</code>] package, which is a [https://github.com/NixOS/nixpkgs/blob/7eee17a8a5868ecf596bbb8c8beb527253ea8f4d/pkgs/by-name/ni/nixos-firewall-tool/nixos-firewall-tool.sh thin wrapper] around <code>iptables</code>.		== Tips and tricks ==

	== ~~Warning~~ ==		=== Temporary firewall rules ===

	~~Firewall~~ rules ~~may be overwritten by Docker~~, ~~as per~~ https://github.com/NixOS/nixpkgs/~~issues~~/~~111852~~		If using iptables, for temporary changes to the firewall rules, you can install the [https://search.nixos.org/packages?query=nixos-firewall-tool <code>nixos-firewall-tool</code>] package, which is a [https://github.com/NixOS/nixpkgs/blob/7eee17a8a5868ecf596bbb8c8beb527253ea8f4d/pkgs/by-name/ni/nixos-firewall-tool/nixos-firewall-tool.sh thin wrapper] around <code>iptables</code>.

	[[Category:Server]]		[[Category:Server]]
	[[Category:Applications]]		[[Category:Applications]]

Pigs: /* Configuration */Use current channel for search.nixos.org link

2025-05-07T16:43:42Z

Configuration: Use current channel for search.nixos.org link

← Older revision		Revision as of 16:43, 7 May 2025
Line 38:		Line 38:
	In this case, ports <code>80</code> and <code>443</code> will be allowed for the interface <code>eth0</code>.		In this case, ports <code>80</code> and <code>443</code> will be allowed for the interface <code>eth0</code>.

	If using iptables, for temporary changes to the firewall rules, you can install the [https://search.nixos.org/packages?~~channel=24.11&from=0&size=50&sort=relevance&type=packages&~~query=nixos-firewall-tool <code>nixos-firewall-tool</code>] package, which is a [https://github.com/NixOS/nixpkgs/blob/7eee17a8a5868ecf596bbb8c8beb527253ea8f4d/pkgs/by-name/ni/nixos-firewall-tool/nixos-firewall-tool.sh thin wrapper] around <code>iptables</code>.		If using iptables, for temporary changes to the firewall rules, you can install the [https://search.nixos.org/packages?query=nixos-firewall-tool <code>nixos-firewall-tool</code>] package, which is a [https://github.com/NixOS/nixpkgs/blob/7eee17a8a5868ecf596bbb8c8beb527253ea8f4d/pkgs/by-name/ni/nixos-firewall-tool/nixos-firewall-tool.sh thin wrapper] around <code>iptables</code>.

	== Warning ==		== Warning ==

Fidgetingbits: /* Configuration */ clarify nixos-firewall-tool is iptables only

2024-12-01T13:00:54Z

Configuration: clarify nixos-firewall-tool is iptables only

← Older revision		Revision as of 13:00, 1 December 2024
Line 38:		Line 38:
	In this case, ports <code>80</code> and <code>443</code> will be allowed for the interface <code>eth0</code>.		In this case, ports <code>80</code> and <code>443</code> will be allowed for the interface <code>eth0</code>.

	~~For~~ temporary changes to the firewall rules, you can ~~use~~ the <code>nixos-firewall-tool</code> ~~command~~.		If using iptables, for temporary changes to the firewall rules, you can install the [https://search.nixos.org/packages?channel=24.11&from=0&size=50&sort=relevance&type=packages&query=nixos-firewall-tool <code>nixos-firewall-tool</code>] package, which is a [https://github.com/NixOS/nixpkgs/blob/7eee17a8a5868ecf596bbb8c8beb527253ea8f4d/pkgs/by-name/ni/nixos-firewall-tool/nixos-firewall-tool.sh thin wrapper] around <code>iptables</code>.

	== Warning ==		== Warning ==

Ahi6: Mention nixos-firewall-tool

2024-12-01T10:21:27Z

Mention nixos-firewall-tool

← Older revision		Revision as of 10:21, 1 December 2024
Line 37:		Line 37:

	In this case, ports <code>80</code> and <code>443</code> will be allowed for the interface <code>eth0</code>.		In this case, ports <code>80</code> and <code>443</code> will be allowed for the interface <code>eth0</code>.

			For temporary changes to the firewall rules, you can use the <code>nixos-firewall-tool</code> command.

	== Warning ==		== Warning ==

Klinger: Category:Server Category:Applications

2024-04-19T17:43:27Z

Category:Server Category:Applications

← Older revision		Revision as of 17:43, 19 April 2024
Line 41:		Line 41:

	Firewall rules may be overwritten by Docker, as per https://github.com/NixOS/nixpkgs/issues/111852		Firewall rules may be overwritten by Docker, as per https://github.com/NixOS/nixpkgs/issues/111852

			[[Category:Server]]
			[[Category:Applications]]

imported>Bowmanjd: So minor, but I was confused if networking.nftables _replaced_ or _supplemented_ networking.firewall, and I noticed example configs online that suggested others may be confused as well.

2023-12-10T21:50:54Z

So minor, but I was confused if networking.nftables _replaced_ or _supplemented_ networking.firewall, and I noticed example configs online that suggested others may be confused as well.

← Older revision		Revision as of 21:50, 10 December 2023
Line 1:		Line 1:
	NixOS provides an interface to configure the firewall through the option <code>networking.firewall</code>.		NixOS provides an interface to configure the firewall through the option <code>networking.firewall</code>.

	The default firewall uses [https://www.netfilter.org/ iptables]. To use the newer [https://www.nftables.org/ nftables] instead, set <code>networking.nftables.enable = true;</code>		The default firewall uses [https://www.netfilter.org/ iptables]. To use the newer [https://www.nftables.org/ nftables] instead, additionally set <code>networking.nftables.enable = true;</code>

	== Enable ==		== Enable ==