public/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

nixos/firewall: Don't allow traffic during reload

Browse Source
This commit is contained in:
William A. Kennington III 2014-09-15 20:04:31 -07:00
parent 4d193b7262
commit fd7b9b4291
1 changed files with 14 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
nixos/modules/services/networking/firewall.nix
View File

@ -264,7 +264,7 @@ in
message = "This kernel does not support disabling conntrack helpers"; } message = "This kernel does not support disabling conntrack helpers"; }
]; ];
systemd.services.firewall = systemd.services.firewall = rec
{ description = "Firewall"; { description = "Firewall";
wantedBy = [ "network.target" ]; wantedBy = [ "network.target" ];
@ -277,8 +277,12 @@ in
# better have all necessary modules already loaded. # better have all necessary modules already loaded.
unitConfig.ConditionCapability = "CAP_NET_ADMIN"; unitConfig.ConditionCapability = "CAP_NET_ADMIN";
serviceConfig.Type = "oneshot"; reloadIfChanged = true;
serviceConfig.RemainAfterExit = true;
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
};
script = script =
'' ''
@ -417,11 +421,17 @@ in
ip46tables -A INPUT -j nixos-fw ip46tables -A INPUT -j nixos-fw
''; '';
reload = ''
${helpers}
ip46tables -A INPUT -j DROP
${script}
ip46tables -D INPUT -j DROP || true # extraCommands might delete the above rule and cause this to fail
'';
postStop = postStop =
'' ''
${helpers} ${helpers}
ip46tables -D INPUT -j nixos-fw || true ip46tables -D INPUT -j nixos-fw || true
#ip46tables -P INPUT ACCEPT
''; '';
}; };