Unverified Commit f0bc4f6b authored by Sandro Jäckel's avatar Sandro Jäckel Committed by GitHub
Browse files

nixos-firewall-tool: add nftables support (#324615)

parents 02b61c15 9d662d95

maintainers/maintainer-list.nix

+12 −0
Original line number Diff line number Diff line
@@ -7608,6 +7608,12 @@ 
    githubId = 91987;

    name = "Jim Garrison";

  };

  garyguo = {

    email = "gary@garyguo.net";

    github = "nbdd0121";

    githubId = 4065244;

    name = "Gary Guo";

  };

  gavin = {

    email = "gavin.rogers@holo.host";

    github = "gavinrogers";
@@ -18709,6 +18715,12 @@ 
    githubId = 141248;

    name = "Ramses";

  };

  rvfg = {

    email = "i@rvf6.com";

    github = "duament";

    githubId = 30264485;

    name = "Rvfg";

  };

  rvl = {

    email = "dev+nix@rodney.id.au";

    github = "rvl";

nixos/doc/manual/release-notes/rl-2411.section.md

+2 −0
Original line number Diff line number Diff line
@@ -720,6 +720,8 @@ 
  This saves UPS battery and ensures that host(s) get back up again when power comes back, even in the scenario when the UPS would have had enough capacity to keep power on during the whole power outage.

  If you like the old behaviour of keeping the UPSs on (and emptying the battery) after the host(s) have shut down, and risk not getting a power cycle event to get the host(s) back up, set `power.ups.upsmon.settings.POWERDOWNFLAG = null;`.



- `nixos-firewall-tool` now supports nftables in addition to iptables and is installed by default when NixOS firewall is enabled.



- Support for *runner registration tokens* has been [deprecated](https://gitlab.com/gitlab-org/gitlab/-/issues/380872)

  in `gitlab-runner` 15.6 and is expected to be removed in `gitlab-runner` 18.0. Configuration of existing runners

  should be changed to using *runner authentication tokens* by configuring

nixos/modules/services/networking/firewall-iptables.nix

+0 −1
Original line number Diff line number Diff line
@@ -297,7 +297,6 @@ in 
      }

    ];



    environment.systemPackages = [ pkgs.nixos-firewall-tool ];

    networking.firewall.checkReversePath = lib.mkIf (!kernelHasRPFilter) (lib.mkDefault false);



    systemd.services.firewall = {

nixos/modules/services/networking/firewall-nftables.nix

+9 −0
Original line number Diff line number Diff line
@@ -81,6 +81,13 @@ in 


    networking.nftables.tables."nixos-fw".family = "inet";

    networking.nftables.tables."nixos-fw".content = ''

        set temp-ports {

          comment "Temporarily opened ports"

          type inet_proto . inet_service

          flags interval

          auto-merge

        }



        ${lib.optionalString (cfg.checkReversePath != false) ''

          chain rpfilter {

            type filter hook prerouting priority mangle + 10; policy drop;
@@ -147,6 +154,8 @@ in 
            ''

          ) cfg.allInterfaces)}



          meta l4proto . th dport @temp-ports accept



          ${lib.optionalString cfg.allowPing ''

            icmp type echo-request ${lib.optionalString (cfg.pingLimit != null) "limit rate ${cfg.pingLimit}"} accept comment "allow ping"

          ''}

nixos/modules/services/networking/firewall.nix

+4 −1
Original line number Diff line number Diff line
@@ -274,7 +274,10 @@ in 


    networking.firewall.trustedInterfaces = [ "lo" ];



    environment.systemPackages = [ cfg.package ] ++ cfg.extraPackages;

    environment.systemPackages = [

      cfg.package

      pkgs.nixos-firewall-tool

    ] ++ cfg.extraPackages;



    boot.kernelModules = (lib.optional cfg.autoLoadConntrackHelpers "nf_conntrack")

      ++ map (x: "nf_conntrack_${x}") cfg.connectionTrackingModules;