mirrors/nixpkgs
1
0
Fork 1
mirror of https://github.com/NixOS/nixpkgs.git synced 2024-09-11 15:08:33 +01:00
Code Issues Wiki Activity

Merge pull request #4111 from wkennington/master.nat

Browse source 
Allow nat to leverage the firewall unit if available
This commit is contained in:
William A. Kennington III 2014-09-15 21:33:24 -07:00
parent 43c2bc0f8c 1321fd175d
commit 0b586622db
2 changed files with 76 additions and 51 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
nixos/modules/services/networking/firewall.nix
View file

@ -240,6 +240,18 @@ in
'';
};
networking.firewall.extraStopCommands = mkOption {
type = types.lines;
default = "";
example = "iptables -P INPUT ACCEPT";
description =
''
Additional shell commands executed as part of the firewall
shutdown script. These are executed just after the removal
of the nixos input rule.
'';
};
};
@ -432,6 +444,7 @@ in
''
${helpers}
ip46tables -D INPUT -j nixos-fw || true
${cfg.extraStopCommands}
'';
};

114
nixos/modules/services/networking/nat.nix
View file

@ -12,6 +12,41 @@ let
dest = if cfg.externalIP == null then "-j MASQUERADE" else "-j SNAT --to-source ${cfg.externalIP}";
flushNat = ''
iptables -w -t nat -F PREROUTING
iptables -w -t nat -F POSTROUTING
iptables -w -t nat -X
'';
setupNat = ''
# We can't match on incoming interface in POSTROUTING, so
# mark packets coming from the external interfaces.
${concatMapStrings (iface: ''
iptables -w -t nat -A PREROUTING \
-i '${iface}' -j MARK --set-mark 1
'') cfg.internalInterfaces}
# NAT the marked packets.
${optionalString (cfg.internalInterfaces != []) ''
iptables -w -t nat -A POSTROUTING -m mark --mark 1 \
-o ${cfg.externalInterface} ${dest}
''}
# NAT packets coming from the internal IPs.
${concatMapStrings (range: ''
iptables -w -t nat -A POSTROUTING \
-s '${range}' -o ${cfg.externalInterface} ${dest}
'') cfg.internalIPs}
# NAT from external ports to internal ports.
${concatMapStrings (fwd: ''
iptables -w -t nat -A PREROUTING \
-i ${cfg.externalInterface} -p tcp \
--dport ${builtins.toString fwd.sourcePort} \
-j DNAT --to-destination ${fwd.destination}
'') cfg.forwardPorts}
'';
in
{
@ -109,57 +144,34 @@ in
environment.systemPackages = [ pkgs.iptables ];
boot.kernelModules = [ "nf_nat_ftp" ];
jobs.nat =
{ description = "Network Address Translation";
startOn = "started network-interfaces";
path = [ pkgs.iptables ];
preStart =
''
iptables -w -t nat -F PREROUTING
iptables -w -t nat -F POSTROUTING
iptables -w -t nat -X
# We can't match on incoming interface in POSTROUTING, so
# mark packets coming from the external interfaces.
${concatMapStrings (iface: ''
iptables -w -t nat -A PREROUTING \
-i '${iface}' -j MARK --set-mark 1
'') cfg.internalInterfaces}
# NAT the marked packets.
${optionalString (cfg.internalInterfaces != []) ''
iptables -w -t nat -A POSTROUTING -m mark --mark 1 \
-o ${cfg.externalInterface} ${dest}
''}
# NAT packets coming from the internal IPs.
${concatMapStrings (range: ''
iptables -w -t nat -A POSTROUTING \
-s '${range}' -o ${cfg.externalInterface} ${dest}
'') cfg.internalIPs}
# NAT from external ports to internal ports.
${concatMapStrings (fwd: ''
iptables -w -t nat -A PREROUTING \
-i ${cfg.externalInterface} -p tcp \
--dport ${builtins.toString fwd.sourcePort} \
-j DNAT --to-destination ${fwd.destination}
'') cfg.forwardPorts}
echo 1 > /proc/sys/net/ipv4/ip_forward
'';
postStop =
''
iptables -w -t nat -F PREROUTING
iptables -w -t nat -F POSTROUTING
iptables -w -t nat -X
'';
boot = {
kernelModules = [ "nf_nat_ftp" ];
kernel.sysctl = mkOverride 99 {
"net.ipv4.conf.all.forwarding" = true;
"net.ipv4.conf.default.forwarding" = true;
};
};
networking.firewall = mkIf config.networking.firewall.enable {
extraCommands = mkMerge [ (mkBefore flushNat) setupNat ];
extraStopCommands = flushNat;
};
systemd.services = mkIf (!config.networking.firewall.enable) { nat = {
description = "Network Address Translation";
wantedBy = [ "network.target" ];
after = [ "network-interfaces.target" "systemd-modules-load.service" ];
path = [ pkgs.iptables ];
unitConfig.ConditionCapability = "CAP_NET_ADMIN";
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
};
script = flushNat + setupNat;
postStop = flushNat;
}; };
};
}