mirrors/nixpkgs
1
0
Fork 1
mirror of https://github.com/NixOS/nixpkgs.git synced 2024-11-23 14:11:36 +00:00
Code Issues Wiki Activity

* Add an option for opening UDP ports.

Browse source 
* Accept packets destined for link-local addresses (fe80::/10).

svn path=/nixos/trunk/; revision=26236
This commit is contained in:
Eelco Dolstra 2011-03-09 16:37:16 +00:00
parent d8b69f2fad
commit e884cbed7d
1 changed files with 20 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

21
modules/services/networking/firewall.nix
View file

@ -53,7 +53,7 @@ in
networking.firewall.allowedTCPPorts = mkOption {
default = [];
example = [22 80];
example = [ 22 80 ];
type = types.list types.int;
description =
''
@ -62,6 +62,16 @@ in
'';
};
networking.firewall.allowedUDPPorts = mkOption {
default = [];
example = [ 53 ];
type = types.list types.int;
description =
''
List of open UDP ports.
'';
};
networking.firewall.allowPing = mkOption {
default = false;
type = types.bool;
@ -131,6 +141,14 @@ in
) config.networking.firewall.allowedTCPPorts
}
# Accept packets on the allowed UDP ports.
${concatMapStrings (port:
''
ip46tables -A INPUT -p udp --dport ${toString port} -j ACCEPT
''
) config.networking.firewall.allowedUDPPorts
}
# Accept IPv4 multicast. Not a big security risk since
# probably nobody is listening anyway.
iptables -A INPUT -d 224.0.0.0/4 -j ACCEPT
@ -138,6 +156,7 @@ in
# Accept IPv6 ICMP packets on the local link. Otherwise
# stuff like neighbor/router solicitation won't work.
ip6tables -A INPUT -s fe80::/10 -p icmpv6 -j ACCEPT
ip6tables -A INPUT -d fe80::/10 -p icmpv6 -j ACCEPT
# Optionally respond to pings.
${optionalString cfg.allowPing ''