public/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

* Cleanup.

Browse Source 
svn path=/nixos/trunk/; revision=26244
This commit is contained in:
Eelco Dolstra 2011-03-10 09:39:17 +00:00
parent e884cbed7d
commit d6424efbfb
1 changed files with 10 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
modules/services/networking/firewall.nix
View File

@ -1,3 +1,5 @@
# This module enables a simple firewall.
{ config, pkgs, ... }: { config, pkgs, ... }:
with pkgs.lib; with pkgs.lib;
@ -18,7 +20,10 @@ in
default = false; default = false;
description = description =
'' ''
Whether to enable the firewall. Whether to enable the firewall. This is a simple stateful
firewall that blocks connection attempts to unauthorised TCP
or UDP ports on this machine. It does not affect packet
forwarding.
''; '';
}; };
@ -91,7 +96,7 @@ in
# doesn't deal with such Upstart jobs properly (it starts them if # doesn't deal with such Upstart jobs properly (it starts them if
# they are changed, regardless of whether the start condition # they are changed, regardless of whether the start condition
# holds). # holds).
config = mkIf config.networking.firewall.enable { config = mkIf cfg.enable {
environment.systemPackages = [ pkgs.iptables ]; environment.systemPackages = [ pkgs.iptables ];
@ -102,7 +107,7 @@ in
preStart = preStart =
'' ''
# Helper command to manipulate both the IPv4 and IPv6 filters. # Helper command to manipulate both the IPv4 and IPv6 tables.
ip46tables() { ip46tables() {
iptables "$@" iptables "$@"
ip6tables "$@" ip6tables "$@"
@ -138,7 +143,7 @@ in
'' ''
ip46tables -A INPUT -p tcp --dport ${toString port} -j ACCEPT ip46tables -A INPUT -p tcp --dport ${toString port} -j ACCEPT
'' ''
) config.networking.firewall.allowedTCPPorts ) cfg.allowedTCPPorts
} }
# Accept packets on the allowed UDP ports. # Accept packets on the allowed UDP ports.
@ -146,7 +151,7 @@ in
'' ''
ip46tables -A INPUT -p udp --dport ${toString port} -j ACCEPT ip46tables -A INPUT -p udp --dport ${toString port} -j ACCEPT
'' ''
) config.networking.firewall.allowedUDPPorts ) cfg.allowedUDPPorts
} }
# Accept IPv4 multicast. Not a big security risk since # Accept IPv4 multicast. Not a big security risk since