public/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

* Add an option for opening UDP ports.

Browse Source 
* Accept packets destined for link-local addresses (fe80::/10).

svn path=/nixos/trunk/; revision=26236
This commit is contained in:
Eelco Dolstra 2011-03-09 16:37:16 +00:00
parent d8b69f2fad
commit e884cbed7d
1 changed files with 20 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
modules/services/networking/firewall.nix
View File

@ -53,7 +53,7 @@ in
networking.firewall.allowedTCPPorts = mkOption { networking.firewall.allowedTCPPorts = mkOption {
default = []; default = [];
example = [22 80]; example = [ 22 80 ];
type = types.list types.int; type = types.list types.int;
description = description =
'' ''
@ -62,6 +62,16 @@ in
''; '';
}; };
networking.firewall.allowedUDPPorts = mkOption {
default = [];
example = [ 53 ];
type = types.list types.int;
description =
''
List of open UDP ports.
'';
};
networking.firewall.allowPing = mkOption { networking.firewall.allowPing = mkOption {
default = false; default = false;
type = types.bool; type = types.bool;
@ -131,6 +141,14 @@ in
) config.networking.firewall.allowedTCPPorts ) config.networking.firewall.allowedTCPPorts
} }
# Accept packets on the allowed UDP ports.
${concatMapStrings (port:
''
ip46tables -A INPUT -p udp --dport ${toString port} -j ACCEPT
''
) config.networking.firewall.allowedUDPPorts
}
# Accept IPv4 multicast. Not a big security risk since # Accept IPv4 multicast. Not a big security risk since
# probably nobody is listening anyway. # probably nobody is listening anyway.
iptables -A INPUT -d 224.0.0.0/4 -j ACCEPT iptables -A INPUT -d 224.0.0.0/4 -j ACCEPT
@ -138,6 +156,7 @@ in
# Accept IPv6 ICMP packets on the local link. Otherwise # Accept IPv6 ICMP packets on the local link. Otherwise
# stuff like neighbor/router solicitation won't work. # stuff like neighbor/router solicitation won't work.
ip6tables -A INPUT -s fe80::/10 -p icmpv6 -j ACCEPT ip6tables -A INPUT -s fe80::/10 -p icmpv6 -j ACCEPT
ip6tables -A INPUT -d fe80::/10 -p icmpv6 -j ACCEPT
# Optionally respond to pings. # Optionally respond to pings.
${optionalString cfg.allowPing '' ${optionalString cfg.allowPing ''