* A very basic firewall that rejects all incoming connections except
for the ports defined in networking.firewall.allowedTCPPorts. svn path=/nixos/branches/modular-nixos/; revision=16460
This commit is contained in:
parent
38d594deec
commit
264b49fce7
70
modules/services/networking/firewall.nix
Normal file
70
modules/services/networking/firewall.nix
Normal file
|
@ -0,0 +1,70 @@
|
|||
{pkgs, config, ...}:
|
||||
|
||||
let
|
||||
|
||||
iptables = "${pkgs.iptables}/sbin/iptables";
|
||||
|
||||
in
|
||||
|
||||
{
|
||||
|
||||
###### interface
|
||||
|
||||
options = {
|
||||
|
||||
networking.firewall.allowedTCPPorts = pkgs.lib.mkOption {
|
||||
default = [];
|
||||
example = [22 80];
|
||||
type = pkgs.lib.types.list pkgs.lib.types.int;
|
||||
description =
|
||||
''
|
||||
List of TCP ports on which incoming connections are
|
||||
accepted.
|
||||
'';
|
||||
};
|
||||
|
||||
};
|
||||
|
||||
|
||||
###### implementation
|
||||
|
||||
config = {
|
||||
|
||||
environment.systemPackages = [pkgs.iptables];
|
||||
|
||||
jobs = pkgs.lib.singleton
|
||||
{ name = "firewall";
|
||||
|
||||
preStart =
|
||||
''
|
||||
${iptables} -F
|
||||
|
||||
# Accept all traffic on the loopback interface.
|
||||
${iptables} -A INPUT -i lo -j ACCEPT
|
||||
|
||||
# Accept packets from established or related connections.
|
||||
${iptables} -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
|
||||
|
||||
# Accept connections to the allowed TCP ports.
|
||||
${pkgs.lib.concatMapStrings (port:
|
||||
''
|
||||
${iptables} -A INPUT -p tcp --dport ${toString port} -j ACCEPT
|
||||
''
|
||||
) config.networking.firewall.allowedTCPPorts
|
||||
}
|
||||
|
||||
# Drop everything else.
|
||||
${iptables} -A INPUT -j DROP
|
||||
'';
|
||||
|
||||
postStop =
|
||||
''
|
||||
${iptables} -F
|
||||
'';
|
||||
};
|
||||
|
||||
networking.firewall.allowedTCPPorts = [22];
|
||||
|
||||
};
|
||||
|
||||
}
|
|
@ -131,6 +131,10 @@ in
|
|||
exec = "${openssh}/sbin/sshd -D -h /etc/ssh/ssh_host_dsa_key -f ${sshdConfig}";
|
||||
};
|
||||
|
||||
# !!! This barfs because of the mkIf ("value is a list while an
|
||||
#attribute set was expected") :-(
|
||||
#networking.firewall.allowedTCPPorts = [22];
|
||||
|
||||
};
|
||||
|
||||
}
|
||||
|
|
Loading…
Reference in a new issue