···

       
1
       
1
       
 
       
# Ad-Hoc Configuration {#ad-hoc-network-config}

     

       
2
       
2
       
 
       


     

       
3
       
3
       
-
       
You can use [`networking.localCommands`](options.html#opt-networking.localCommands) to

     

       
3
       
3
       
+
       
You can use [](#opt-networking.localCommands) to

     

       
4
       
4
       
 
       
specify shell commands to be run at the end of `network-setup.service`. This

     

       
5
       
5
       
 
       
is useful for doing network configuration not covered by the existing NixOS

     

       
6
       
6
       
 
       
modules. For instance, to statically configure an IPv6 address:

     

···

       
17
       
17
       
 
       


     

       
18
       
18
       
 
       
Note that TCP port 22 (ssh) is opened automatically if the SSH daemon is

     

       
19
       
19
       
 
       
enabled (`services.openssh.enable = true`). UDP ports can be opened through

     

       
20
       
20
       
-
       
[`networking.firewall.allowedUDPPorts`](options.html#opt-networking.firewall.allowedUDPPorts).

     

       
20
       
20
       
+
       
[](#opt-networking.firewall.allowedUDPPorts).

     

       
21
       
21
       
 
       


     

       
22
       
22
       
 
       
To open ranges of TCP ports:

     

       
23
       
23
       
 
       


     
···

       
29
       
29
       
 
       
```

     

       
30
       
30
       
 
       


     

       
31
       
31
       
 
       
Similarly, UDP port ranges can be opened through

     

       
32
       
32
       
-
       
[`networking.firewall.allowedUDPPortRanges`](options.html#opt-networking.firewall.allowedUDPPortRanges).

     

       
32
       
32
       
+
       
[](#opt-networking.firewall.allowedUDPPortRanges).

     

···

       
25
       
25
       
 
       
configuration is performed by `network-setup.service`.

     

       
26
       
26
       
 
       
:::

     

       
27
       
27
       
 
       


     

       
28
       
28
       
-
       
The host name is set using [`networking.hostName`](options.html#opt-networking.hostName):

     

       
28
       
28
       
+
       
The host name is set using [](#opt-networking.hostName):

     

       
29
       
29
       
 
       


     

       
30
       
30
       
 
       
```nix

     

       
31
       
31
       
 
       
networking.hostName = "cartman";

     

···

       
3
       
3
       
 
       
IPv6 is enabled by default. Stateless address autoconfiguration is used

     

       
4
       
4
       
 
       
to automatically assign IPv6 addresses to all interfaces, and Privacy

     

       
5
       
5
       
 
       
Extensions (RFC 4946) are enabled by default. You can adjust the default

     

       
6
       
6
       
-
       
for this by setting [`networking.tempAddresses`](options.html#opt-networking.tempAddresses). This option

     

       
6
       
6
       
+
       
for this by setting [](#opt-networking.tempAddresses). This option

     

       
7
       
7
       
 
       
may be overridden on a per-interface basis by

     

       
8
       
8
       
-
       
[`networking.interfaces.<name>.tempAddress`](options.html#opt-networking.interfaces._name_.tempAddress). You can disable

     

       
8
       
8
       
+
       
[](#opt-networking.interfaces._name_.tempAddress). You can disable

     

       
9
       
9
       
 
       
IPv6 support globally by setting:

     

       
10
       
10
       
 
       


     

       
11
       
11
       
 
       
```nix

     

···

       
22
       
22
       
 
       
details on their usage. Some desktop environments (GNOME, KDE) have

     

       
23
       
23
       
 
       
their own configuration tools for NetworkManager. On XFCE, there is no

     

       
24
       
24
       
 
       
configuration tool for NetworkManager by default: by enabling

     

       
25
       
25
       
-
       
[`programs.nm-applet.enable`](options.html#opt-programs.nm-applet.enable), the graphical applet will be

     

       
25
       
25
       
+
       
[](#opt-programs.nm-applet.enable), the graphical applet will be

     

       
26
       
26
       
 
       
installed and will launch automatically when the graphical session is

     

       
27
       
27
       
 
       
started.

     

       
28
       
28
       
 
       


     

···

       
14
       
14
       
 
       
change](https://github.com/systemd/systemd/issues/3715#issue-165347602).

     

       
15
       
15
       
 
       
If this is undesirable, for example if you have a single ethernet card,

     

       
16
       
16
       
 
       
you can revert to the traditional scheme by setting

     

       
17
       
17
       
-
       
[`networking.usePredictableInterfaceNames`](options.html#opt-networking.usePredictableInterfaceNames)

     

       
17
       
17
       
+
       
[](#opt-networking.usePredictableInterfaceNames)

     

       
18
       
18
       
 
       
to `false`.

     

       
19
       
19
       
 
       


     

       
20
       
20
       
 
       
## Assigning custom names {#sec-custom-ifnames}

     

···

       
8
       
8
       
 
       


     

       
9
       
9
       
 
       
By default, root logins using a password are disallowed. They can be

     

       
10
       
10
       
 
       
disabled entirely by setting

     

       
11
       
11
       
-
       
[`services.openssh.permitRootLogin`](options.html#opt-services.openssh.permitRootLogin) to `"no"`.

     

       
11
       
11
       
+
       
[](#opt-services.openssh.permitRootLogin) to `"no"`.

     

       
12
       
12
       
 
       


     

       
13
       
13
       
 
       
You can declaratively specify authorised RSA/DSA public keys for a user

     

       
14
       
14
       
 
       
as follows:

     

···

       
1
       
1
       
 
       
<section xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" xml:id="ad-hoc-network-config">

     

       
2
       
2
       
 
       
  <title>Ad-Hoc Configuration</title>

     

       
3
       
3
       
 
       
  <para>

     

       
4
       
4
       
-
       
    You can use

     

       
5
       
5
       
-
       
    <link xlink:href="options.html#opt-networking.localCommands"><literal>networking.localCommands</literal></link>

     

       
6
       
6
       
-
       
    to specify shell commands to be run at the end of

     

       
4
       
4
       
+
       
    You can use <xref linkend="opt-networking.localCommands" /> to

     

       
5
       
5
       
+
       
    specify shell commands to be run at the end of

     

       
7
       
6
       
 
       
    <literal>network-setup.service</literal>. This is useful for doing

     

       
8
       
7
       
 
       
    network configuration not covered by the existing NixOS modules. For

     

       
9
       
8
       
 
       
    instance, to statically configure an IPv6 address:

     

···

       
21
       
21
       
 
       
    daemon is enabled

     

       
22
       
22
       
 
       
    (<literal>services.openssh.enable = true</literal>). UDP ports can

     

       
23
       
23
       
 
       
    be opened through

     

       
24
       
24
       
-
       
    <link xlink:href="options.html#opt-networking.firewall.allowedUDPPorts"><literal>networking.firewall.allowedUDPPorts</literal></link>.

     

       
24
       
24
       
+
       
    <xref linkend="opt-networking.firewall.allowedUDPPorts" />.

     

       
25
       
25
       
 
       
  </para>

     

       
26
       
26
       
 
       
  <para>

     

       
27
       
27
       
 
       
    To open ranges of TCP ports:

     
···

       
34
       
34
       
 
       
</programlisting>

     

       
35
       
35
       
 
       
  <para>

     

       
36
       
36
       
 
       
    Similarly, UDP port ranges can be opened through

     

       
37
       
37
       
-
       
    <link xlink:href="options.html#opt-networking.firewall.allowedUDPPortRanges"><literal>networking.firewall.allowedUDPPortRanges</literal></link>.

     

       
37
       
37
       
+
       
    <xref linkend="opt-networking.firewall.allowedUDPPortRanges" />.

     

       
38
       
38
       
 
       
  </para>

     

       
39
       
39
       
 
       
</section>

     

···

       
30
       
30
       
 
       
  </note>

     

       
31
       
31
       
 
       
  <para>

     

       
32
       
32
       
 
       
    The host name is set using

     

       
33
       
33
       
-
       
    <link xlink:href="options.html#opt-networking.hostName"><literal>networking.hostName</literal></link>:

     

       
33
       
33
       
+
       
    <xref linkend="opt-networking.hostName" />:

     

       
34
       
34
       
 
       
  </para>

     

       
35
       
35
       
 
       
  <programlisting language="bash">

     

       
36
       
36
       
 
       
networking.hostName = &quot;cartman&quot;;

     

···

       
5
       
5
       
 
       
    used to automatically assign IPv6 addresses to all interfaces, and

     

       
6
       
6
       
 
       
    Privacy Extensions (RFC 4946) are enabled by default. You can adjust

     

       
7
       
7
       
 
       
    the default for this by setting

     

       
8
       
8
       
-
       
    <link xlink:href="options.html#opt-networking.tempAddresses"><literal>networking.tempAddresses</literal></link>.

     

       
9
       
9
       
-
       
    This option may be overridden on a per-interface basis by

     

       
10
       
10
       
-
       
    <link xlink:href="options.html#opt-networking.interfaces._name_.tempAddress"><literal>networking.interfaces.&lt;name&gt;.tempAddress</literal></link>.

     

       
11
       
11
       
-
       
    You can disable IPv6 support globally by setting:

     

       
8
       
8
       
+
       
    <xref linkend="opt-networking.tempAddresses" />. This option may be

     

       
9
       
9
       
+
       
    overridden on a per-interface basis by

     

       
10
       
10
       
+
       
    <xref linkend="opt-networking.interfaces._name_.tempAddress" />. You

     

       
11
       
11
       
+
       
    can disable IPv6 support globally by setting:

     

       
12
       
12
       
 
       
  </para>

     

       
13
       
13
       
 
       
  <programlisting language="bash">

     

       
14
       
14
       
 
       
networking.enableIPv6 = false;

     

···

       
25
       
25
       
 
       
    environments (GNOME, KDE) have their own configuration tools for

     

       
26
       
26
       
 
       
    NetworkManager. On XFCE, there is no configuration tool for

     

       
27
       
27
       
 
       
    NetworkManager by default: by enabling

     

       
28
       
28
       
-
       
    <link xlink:href="options.html#opt-programs.nm-applet.enable"><literal>programs.nm-applet.enable</literal></link>,

     

       
29
       
29
       
-
       
    the graphical applet will be installed and will launch automatically

     

       
30
       
30
       
-
       
    when the graphical session is started.

     

       
28
       
28
       
+
       
    <xref linkend="opt-programs.nm-applet.enable" />, the graphical

     

       
29
       
29
       
+
       
    applet will be installed and will launch automatically when the

     

       
30
       
30
       
+
       
    graphical session is started.

     

       
31
       
31
       
 
       
  </para>

     

       
32
       
32
       
 
       
  <note>

     

       
33
       
33
       
 
       
    <para>

     

···

       
18
       
18
       
 
       
    change</link>. If this is undesirable, for example if you have a

     

       
19
       
19
       
 
       
    single ethernet card, you can revert to the traditional scheme by

     

       
20
       
20
       
 
       
    setting

     

       
21
       
21
       
-
       
    <link xlink:href="options.html#opt-networking.usePredictableInterfaceNames"><literal>networking.usePredictableInterfaceNames</literal></link>

     

       
22
       
22
       
-
       
    to <literal>false</literal>.

     

       
21
       
21
       
+
       
    <xref linkend="opt-networking.usePredictableInterfaceNames" /> to

     

       
22
       
22
       
+
       
    <literal>false</literal>.

     

       
23
       
23
       
 
       
  </para>

     

       
24
       
24
       
 
       
  <section xml:id="sec-custom-ifnames">

     

       
25
       
25
       
 
       
    <title>Assigning custom names</title>

     

···

       
9
       
9
       
 
       
  <para>

     

       
10
       
10
       
 
       
    By default, root logins using a password are disallowed. They can be

     

       
11
       
11
       
 
       
    disabled entirely by setting

     

       
12
       
12
       
-
       
    <link xlink:href="options.html#opt-services.openssh.permitRootLogin"><literal>services.openssh.permitRootLogin</literal></link>

     

       
13
       
13
       
-
       
    to <literal>&quot;no&quot;</literal>.

     

       
12
       
12
       
+
       
    <xref linkend="opt-services.openssh.permitRootLogin" /> to

     

       
13
       
13
       
+
       
    <literal>&quot;no&quot;</literal>.

     

       
14
       
14
       
 
       
  </para>

     

       
15
       
15
       
 
       
  <para>

     

       
16
       
16
       
 
       
    You can declaratively specify authorised RSA/DSA public keys for a