pyrox.dev
1# Firewall {#sec-firewall}
2
3NixOS has a simple stateful firewall that blocks incoming connections
4and other unexpected packets. The firewall applies to both IPv4 and IPv6
5traffic. It is enabled by default. It can be disabled as follows:
6
7```nix
8{ networking.firewall.enable = false; }
9```
10
11If the firewall is enabled, you can open specific TCP ports to the
12outside world:
13
14```nix
15{
16 networking.firewall.allowedTCPPorts = [
17 80
18 443
19 ];
20}
21```
22
23Note that TCP port 22 (ssh) is opened automatically if the SSH daemon is
24enabled (`services.openssh.enable = true`). UDP ports can be opened through
25[](#opt-networking.firewall.allowedUDPPorts).
26
27To open ranges of TCP ports:
28
29```nix
30{
31 networking.firewall.allowedTCPPortRanges = [
32 {
33 from = 4000;
34 to = 4007;
35 }
36 {
37 from = 8000;
38 to = 8010;
39 }
40 ];
41}
42```
43
44Similarly, UDP port ranges can be opened through
45[](#opt-networking.firewall.allowedUDPPortRanges).