pyrox.dev
1{ config, pkgs, lib, ... }:
2with lib;
3let
4 cfg = config.networking.nftables;
5in
6{
7 ###### interface
8
9 options = {
10 networking.nftables.enable = mkOption {
11 type = types.bool;
12 default = false;
13 description =
14 lib.mdDoc ''
15 Whether to enable nftables and use nftables based firewall if enabled.
16 nftables is a Linux-based packet filtering framework intended to
17 replace frameworks like iptables.
18
19 Note that if you have Docker enabled you will not be able to use
20 nftables without intervention. Docker uses iptables internally to
21 setup NAT for containers. This module disables the ip_tables kernel
22 module, however Docker automatically loads the module. Please see
23 <https://github.com/NixOS/nixpkgs/issues/24318#issuecomment-289216273>
24 for more information.
25
26 There are other programs that use iptables internally too, such as
27 libvirt. For information on how the two firewalls interact, see
28 <https://wiki.nftables.org/wiki-nftables/index.php/Troubleshooting#Question_4._How_do_nftables_and_iptables_interact_when_used_on_the_same_system.3F>.
29 '';
30 };
31
32 networking.nftables.checkRuleset = mkOption {
33 type = types.bool;
34 default = true;
35 description = lib.mdDoc ''
36 Run `nft check` on the ruleset to spot syntax errors during build.
37 Because this is executed in a sandbox, the check might fail if it requires
38 access to any environmental factors or paths outside the Nix store.
39 To circumvent this, the ruleset file can be edited using the preCheckRuleset
40 option to work in the sandbox environment.
41 '';
42 };
43
44 networking.nftables.preCheckRuleset = mkOption {
45 type = types.lines;
46 default = "";
47 example = lib.literalExpression ''
48 sed 's/skgid meadow/skgid nogroup/g' -i ruleset.conf
49 '';
50 description = lib.mdDoc ''
51 This script gets run before the ruleset is checked. It can be used to
52 create additional files needed for the ruleset check to work, or modify
53 the ruleset for cases the build environment cannot cover.
54 '';
55 };
56
57 networking.nftables.ruleset = mkOption {
58 type = types.lines;
59 default = "";
60 example = ''
61 # Check out https://wiki.nftables.org/ for better documentation.
62 # Table for both IPv4 and IPv6.
63 table inet filter {
64 # Block all incoming connections traffic except SSH and "ping".
65 chain input {
66 type filter hook input priority 0;
67
68 # accept any localhost traffic
69 iifname lo accept
70
71 # accept traffic originated from us
72 ct state {established, related} accept
73
74 # ICMP
75 # routers may also want: mld-listener-query, nd-router-solicit
76 ip6 nexthdr icmpv6 icmpv6 type { destination-unreachable, packet-too-big, time-exceeded, parameter-problem, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert } accept
77 ip protocol icmp icmp type { destination-unreachable, router-advertisement, time-exceeded, parameter-problem } accept
78
79 # allow "ping"
80 ip6 nexthdr icmpv6 icmpv6 type echo-request accept
81 ip protocol icmp icmp type echo-request accept
82
83 # accept SSH connections (required for a server)
84 tcp dport 22 accept
85
86 # count and drop any other traffic
87 counter drop
88 }
89
90 # Allow all outgoing connections.
91 chain output {
92 type filter hook output priority 0;
93 accept
94 }
95
96 chain forward {
97 type filter hook forward priority 0;
98 accept
99 }
100 }
101 '';
102 description =
103 lib.mdDoc ''
104 The ruleset to be used with nftables. Should be in a format that
105 can be loaded using "/bin/nft -f". The ruleset is updated atomically.
106 This option conflicts with rulesetFile.
107 '';
108 };
109 networking.nftables.rulesetFile = mkOption {
110 type = types.nullOr types.path;
111 default = null;
112 description =
113 lib.mdDoc ''
114 The ruleset file to be used with nftables. Should be in a format that
115 can be loaded using "nft -f". The ruleset is updated atomically.
116 This option conflicts with ruleset and nftables based firewall.
117 '';
118 };
119 };
120
121 ###### implementation
122
123 config = mkIf cfg.enable {
124 boot.blacklistedKernelModules = [ "ip_tables" ];
125 environment.systemPackages = [ pkgs.nftables ];
126 networking.networkmanager.firewallBackend = mkDefault "nftables";
127 systemd.services.nftables = {
128 description = "nftables firewall";
129 before = [ "network-pre.target" ];
130 wants = [ "network-pre.target" ];
131 wantedBy = [ "multi-user.target" ];
132 reloadIfChanged = true;
133 serviceConfig = let
134 rulesScript = pkgs.writeTextFile {
135 name = "nftables-rules";
136 executable = true;
137 text = ''
138 #! ${pkgs.nftables}/bin/nft -f
139 flush ruleset
140 ${if cfg.rulesetFile != null then ''
141 include "${cfg.rulesetFile}"
142 '' else cfg.ruleset}
143 '';
144 checkPhase = lib.optionalString cfg.checkRuleset ''
145 cp $out ruleset.conf
146 ${cfg.preCheckRuleset}
147 export NIX_REDIRECTS=/etc/protocols=${pkgs.buildPackages.iana-etc}/etc/protocols:/etc/services=${pkgs.buildPackages.iana-etc}/etc/services
148 LD_PRELOAD="${pkgs.buildPackages.libredirect}/lib/libredirect.so ${pkgs.buildPackages.lklWithFirewall.lib}/lib/liblkl-hijack.so" \
149 ${pkgs.buildPackages.nftables}/bin/nft --check --file ruleset.conf
150 '';
151 };
152 in {
153 Type = "oneshot";
154 RemainAfterExit = true;
155 ExecStart = rulesScript;
156 ExecReload = rulesScript;
157 ExecStop = "${pkgs.nftables}/bin/nft flush ruleset";
158 };
159 };
160 };
161}