commit 5ee439eb0807353fdd7725aaa409bb4170bb5d05 · pyrox.dev/nixpkgs

+3 -12

nixos/modules/services/networking/firewall.nix

···

       42
       42
        
       

     

       43
       43
        
         kernelHasRPFilter = ((kernel.config.isEnabled or (x: false)) "IP_NF_MATCH_RPFILTER") || (kernel.features.netfilterRPFilter or false);

     

       44
       44
        
       

     

       45
       45
       -
         helpers =

     

       46
       46
       -
           ''

     

       47
       47
       -
             # Helper command to manipulate both the IPv4 and IPv6 tables.

     

       48
       48
       -
             ip46tables() {

     

       49
       49
       -
               iptables -w "$@"

     

       50
       50
       -
               ${optionalString config.networking.enableIPv6 ''

     

       51
       51
       -
                 ip6tables -w "$@"

     

       52
       52
       -
               ''}

     

       53
       53
       -
             }

     

       54
       54
       -
           '';

     

       45
       45
       +
         helpers = import ./helpers.nix { inherit config lib; };

     

       55
       46
        
       

     

       56
       47
        
         writeShScript = name: text: let dir = pkgs.writeScriptBin name ''

     

       57
       48
        
           #! ${pkgs.runtimeShell} -e

     
···

       271
       262
        
             apply = canonicalizePortList;

     

       272
       263
        
             example = [ 22 80 ];

     

       273
       264
        
             description =

     

       274
       274
       -
               '' 

     

       265
       265
       +
               ''

     

       275
       266
        
                 List of TCP ports on which incoming connections are

     

       276
       267
        
                 accepted.

     

       277
       268
        
               '';

     
···

       282
       273
        
             default = [ ];

     

       283
       274
        
             example = [ { from = 8999; to = 9003; } ];

     

       284
       275
        
             description =

     

       285
       285
       -
               '' 

     

       276
       276
       +
               ''

     

       286
       277
        
                 A range of TCP ports on which incoming connections are

     

       287
       278
        
                 accepted.

     

       288
       279
        
               '';

+11

nixos/modules/services/networking/helpers.nix

···

       1
       1
       +
       { config, lib, ... }: ''

     

       2
       2
       +
         # Helper command to manipulate both the IPv4 and IPv6 tables.

     

       3
       3
       +
         ip46tables() {

     

       4
       4
       +
           iptables -w "$@"

     

       5
       5
       +
           ${

     

       6
       6
       +
             lib.optionalString config.networking.enableIPv6 ''

     

       7
       7
       +
               ip6tables -w "$@"

     

       8
       8
       +
             ''

     

       9
       9
       +
           }

     

       10
       10
       +
         }

     

       11
       11
       +
       ''

+4 -1

nixos/modules/services/networking/nat.nix

···

       7
       7
        
       with lib;

     

       8
       8
        
       

     

       9
       9
        
       let

     

       10
       10
       -
       

     

       11
       10
        
         cfg = config.networking.nat;

     

       12
       11
        
       

     

       13
       12
        
         dest = if cfg.externalIP == null then "-j MASQUERADE" else "-j SNAT --to-source ${cfg.externalIP}";

     

       14
       13
        
       

     

       14
       14
       +
         helpers = import ./helpers.nix { inherit config lib; };

     

       15
       15
       +
       

     

       15
       16
        
         flushNat = ''

     

       17
       17
       +
           ${helpers}

     

       16
       18
        
           ip46tables -w -t nat -D PREROUTING -j nixos-nat-pre 2>/dev/null|| true

     

       17
       19
        
           ip46tables -w -t nat -F nixos-nat-pre 2>/dev/null || true

     

       18
       20
        
           ip46tables -w -t nat -X nixos-nat-pre 2>/dev/null || true

     
···

       27
       29
        
         '';

     

       28
       30
        
       

     

       29
       31
        
         setupNat = ''

     

       32
       32
       +
           ${helpers}

     

       30
       33
        
           # Create subchain where we store rules

     

       31
       34
        
           ip46tables -w -t nat -N nixos-nat-pre

     

       32
       35
        
           ip46tables -w -t nat -N nixos-nat-post