blob: 2db34eb1cad1d1c106f69dc3527857817b778db5 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
|
{ config, lib, ... }:
let
cfg = config.networking.firewall;
in
{
config = lib.mkIf (cfg.enable && cfg.backend == "firewalld") {
assertions = [
{
assertion = cfg.interfaces == { };
message = ''
Per interface configurations is not supported with the firewalld based firewall.
Create zones with `services.firewalld.zones` instead.
'';
}
];
boot.kernel.sysctl."net.ipv4.conf.all.rp_filter" =
if cfg.checkReversePath == false then
0
else if cfg.checkReversePath == "loose" then
1
else
2;
services.firewalld = {
settings = {
DefaultZone = lib.mkDefault "nixos-fw-default";
LogDenied =
if cfg.logRefusedConnections then
(if cfg.logRefusedUnicastsOnly then "unicast" else "all")
else
"off";
IPv6_rpfilter =
if cfg.checkReversePath == false then
"no"
else
let
mode = if cfg.checkReversePath == true then "strict" else cfg.checkReversePath;
suffix = if cfg.filterForward then "" else "-forward";
in
"${mode}${suffix}";
};
zones = {
nixos-fw-default = {
target = if cfg.rejectPackets then "%%REJECT%%" else "DROP";
icmpBlockInversion = true;
icmpBlocks = lib.mkIf cfg.allowPing [ "echo-request" ];
ports =
let
f = protocol: port: { inherit protocol port; };
tcpPorts = map (f "tcp") (cfg.allowedTCPPorts ++ cfg.allowedTCPPortRanges);
udpPorts = map (f "udp") (cfg.allowedUDPPorts ++ cfg.allowedUDPPortRanges);
in
tcpPorts ++ udpPorts;
};
trusted.interfaces = cfg.trustedInterfaces;
};
};
};
}
|
