mirrors/nixpkgs
1
0
Fork 1
mirror of https://github.com/NixOS/nixpkgs.git synced 2024-12-04 11:32:03 +00:00
Code Issues Wiki Activity

* Cleanup.

Browse source 
svn path=/nixos/trunk/; revision=26228
This commit is contained in:
Eelco Dolstra 2011-03-09 12:28:44 +00:00
parent 6f1068b0b7
commit 843e1f6c1e
2 changed files with 15 additions and 14 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

26
modules/services/networking/firewall.nix
View file

@ -4,8 +4,6 @@ with pkgs.lib;
let
iptables = "${pkgs.iptables}/sbin/iptables";
cfg = config.networking.firewall;
in
@ -76,47 +74,49 @@ in
# holds).
config = mkIf config.networking.firewall.enable {
environment.systemPackages = [pkgs.iptables];
environment.systemPackages = [ pkgs.iptables ];
jobs.firewall =
{ startOn = "started network-interfaces";
path = [ pkgs.iptables ];
preStart =
''
${iptables} -F
iptables -F
# Accept all traffic on the loopback interface.
${iptables} -A INPUT -i lo -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT
# Accept packets from established or related connections.
${iptables} -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
# Accept connections to the allowed TCP ports.
${concatMapStrings (port:
''
${iptables} -A INPUT -p tcp --dport ${toString port} -j ACCEPT
iptables -A INPUT -p tcp --dport ${toString port} -j ACCEPT
''
) config.networking.firewall.allowedTCPPorts
}
# Accept multicast. Not a big security risk since
# probably nobody is listening anyway.
${iptables} -A INPUT -d 224.0.0.0/4 -j ACCEPT
iptables -A INPUT -d 224.0.0.0/4 -j ACCEPT
# Drop everything else.
${optionalString cfg.logRefusedConnections ''
${iptables} -A INPUT -p tcp --syn -j LOG --log-level info --log-prefix "rejected connection: "
iptables -A INPUT -p tcp --syn -j LOG --log-level info --log-prefix "rejected connection: "
''}
${optionalString cfg.logRefusedPackets ''
${iptables} -A INPUT -j LOG --log-level info --log-prefix "rejected packet: "
iptables -A INPUT -j LOG --log-level info --log-prefix "rejected packet: "
''}
${iptables} -A INPUT -j ${if cfg.rejectPackets then "REJECT" else "DROP"}
iptables -A INPUT -j ${if cfg.rejectPackets then "REJECT" else "DROP"}
'';
postStop =
''
${iptables} -F
'';
iptables -F
'';
};
};

3
modules/tasks/network-interfaces.nix
View file

@ -162,9 +162,10 @@ in
startOn = "stopped udevtrigger";
path = [ config.system.sbin.modprobe pkgs.iproute ];
preStart =
''
export PATH=${config.system.sbin.modprobe}/sbin:${pkgs.iproute}/sbin:$PATH
modprobe af_packet || true
${pkgs.lib.concatMapStrings (i: