Firewall: Difference between revisions

(2 intermediate revisions by 2 users not shown)

Line 6:

{{file|/etc/nixos/configuration.nix|nix|<nowiki>

networking.firewall.enable = true;

</nowiki>}}

Line 18:

{{file|/etc/nixos/configuration.nix|nix|<nowiki>

networking.firewall = {

enable = true;

allowedTCPPorts = [ 80 443 ];

allowedUDPPortRanges = [

{ from = 4000; to = 4007; }

{ from = 8000; to = 8010; }

];

};

</nowiki>}}

Line 39:

{{file|/etc/nixos/configuration.nix|nix|<nowiki>

networking.firewall.interfaces."eth0".allowedTCPPorts = [ 80 443 ];

</nowiki>}}

Line 52:

{{file|/etc/nixos/configuration.nix|nix|<nowiki>

networking.firewall.extraInputRules = ''

ip saddr 130.236.254.0/24 tcp dport 6600 accept

ip6 saddr 2001:6b0:17:f0a0::/64 tcp dport 6600 accept

'';

</nowiki>}}

This will add the two specified rules to the <code>input-allow</code> chain in the <code>nixos-fw</code> table. You should of, ~~course~~ replace, the port and subnets with your own.

This will add the two specified rules to the <code>input-allow</code> chain in the <code>nixos-fw</code> table. You should, of course, replace the port and subnets with your own.

== Tips and tricks ==

Line 68:

=== Temporary firewall rules ===

~~If using iptables, for~~ temporary changes to the firewall rules, you can install the [https://search.nixos.org/packages?query=nixos-firewall-tool <code>nixos-firewall-tool</code>] package, which is a [https://github.com/NixOS/nixpkgs/blob/7eee17a8a5868ecf596bbb8c8beb527253ea8f4d/pkgs/by-name/ni/nixos-firewall-tool/nixos-firewall-tool.sh thin wrapper] around <code>iptables</code>.

For temporary changes to the firewall rules, you can install the [https://search.nixos.org/packages?query=nixos-firewall-tool <code>nixos-firewall-tool</code>] package, which is a [https://github.com/NixOS/nixpkgs/blob/7eee17a8a5868ecf596bbb8c8beb527253ea8f4d/pkgs/by-name/ni/nixos-firewall-tool/nixos-firewall-tool.sh thin wrapper] around <code>iptables</code> and <code>nftables</code>.

[[Category:Server]]

[[Category:Applications]]

@@ Line 6: / Line 6: @@
 {{file|/etc/nixos/configuration.nix|nix|<nowiki>
-  networking.firewall.enable = true;
+networking.firewall.enable = true;
 </nowiki>}}
@@ Line 18: / Line 18: @@
 {{file|/etc/nixos/configuration.nix|nix|<nowiki>
-  networking.firewall = {
+networking.firewall = {
-    enable = true;
+  enable = true;
-    allowedTCPPorts = [ 80 443 ];
+  allowedTCPPorts = [ 80 443 ];
-    allowedUDPPortRanges = [
+  allowedUDPPortRanges = [
-      { from = 4000; to = 4007; }
+    { from = 4000; to = 4007; }
-      { from = 8000; to = 8010; }
+    { from = 8000; to = 8010; }
-    ];
+  ];
-  };
+};
 </nowiki>}}
@@ Line 39: / Line 39: @@
 {{file|/etc/nixos/configuration.nix|nix|<nowiki>
-  networking.firewall.interfaces."eth0".allowedTCPPorts = [ 80 443 ];
+networking.firewall.interfaces."eth0".allowedTCPPorts = [ 80 443 ];
 </nowiki>}}
@@ Line 52: / Line 52: @@
 {{file|/etc/nixos/configuration.nix|nix|<nowiki>
-    networking.firewall.extraInputRules = ''
+networking.firewall.extraInputRules = ''
-      ip saddr 130.236.254.0/24 tcp dport 6600 accept
+  ip saddr 130.236.254.0/24 tcp dport 6600 accept
-      ip6 saddr 2001:6b0:17:f0a0::/64 tcp dport 6600 accept
+  ip6 saddr 2001:6b0:17:f0a0::/64 tcp dport 6600 accept
-    '';
+'';
 </nowiki>}}
-This will add the two specified rules to the <code>input-allow</code> chain in the <code>nixos-fw</code> table. You should of, course replace, the port and subnets with your own.
+This will add the two specified rules to the <code>input-allow</code> chain in the <code>nixos-fw</code> table. You should, of course, replace the port and subnets with your own.
 == Tips and tricks ==
@@ Line 68: / Line 68: @@
 === Temporary firewall rules ===
-If using iptables, for temporary changes to the firewall rules, you can install the [https://search.nixos.org/packages?query=nixos-firewall-tool <code>nixos-firewall-tool</code>] package, which is a [https://github.com/NixOS/nixpkgs/blob/7eee17a8a5868ecf596bbb8c8beb527253ea8f4d/pkgs/by-name/ni/nixos-firewall-tool/nixos-firewall-tool.sh thin wrapper] around <code>iptables</code>.
+For temporary changes to the firewall rules, you can install the [https://search.nixos.org/packages?query=nixos-firewall-tool <code>nixos-firewall-tool</code>] package, which is a [https://github.com/NixOS/nixpkgs/blob/7eee17a8a5868ecf596bbb8c8beb527253ea8f4d/pkgs/by-name/ni/nixos-firewall-tool/nixos-firewall-tool.sh thin wrapper] around <code>iptables</code> and <code>nftables</code>.
 [[Category:Server]]
 [[Category:Applications]]