pyrox.dev
1<section xmlns="http://docbook.org/ns/docbook"
2 xmlns:xlink="http://www.w3.org/1999/xlink"
3 xmlns:xi="http://www.w3.org/2001/XInclude"
4 version="5.0"
5 xml:id="sec-firewall">
6 <title>Firewall</title>
7
8 <para>
9 NixOS has a simple stateful firewall that blocks incoming connections and
10 other unexpected packets. The firewall applies to both IPv4 and IPv6 traffic.
11 It is enabled by default. It can be disabled as follows:
12<programlisting>
13<xref linkend="opt-networking.firewall.enable"/> = false;
14</programlisting>
15 If the firewall is enabled, you can open specific TCP ports to the outside
16 world:
17<programlisting>
18<xref linkend="opt-networking.firewall.allowedTCPPorts"/> = [ 80 443 ];
19</programlisting>
20 Note that TCP port 22 (ssh) is opened automatically if the SSH daemon is
21 enabled (<option><xref linkend="opt-services.openssh.enable"/> =
22 true</option>). UDP ports can be opened through
23 <xref linkend="opt-networking.firewall.allowedUDPPorts"/>.
24 </para>
25
26 <para>
27 To open ranges of TCP ports:
28<programlisting>
29<xref linkend="opt-networking.firewall.allowedTCPPortRanges"/> = [
30 { from = 4000; to = 4007; }
31 { from = 8000; to = 8010; }
32];
33</programlisting>
34 Similarly, UDP port ranges can be opened through
35 <xref linkend="opt-networking.firewall.allowedUDPPortRanges"/>.
36 </para>
37
38 <para>
39 Also of interest is
40<programlisting>
41<xref linkend="opt-networking.firewall.allowPing"/> = true;
42</programlisting>
43 to allow the machine to respond to ping requests. (ICMPv6 pings are always
44 allowed.)
45 </para>
46</section>