From 12161f3183ce0b4d538fbd80b6e05ee947e03e04 Mon Sep 17 00:00:00 2001 From: Eelco Dolstra Date: Wed, 9 Mar 2011 15:28:47 +0000 Subject: [PATCH] * Add a firewall option to allow pings. (Maybe this should be enabled by default.) svn path=/nixos/trunk/; revision=26233 --- modules/services/networking/firewall.nix | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/modules/services/networking/firewall.nix b/modules/services/networking/firewall.nix index 2f0fe4f81c2..9c46acd3af8 100644 --- a/modules/services/networking/firewall.nix +++ b/modules/services/networking/firewall.nix @@ -62,6 +62,15 @@ in ''; }; + networking.firewall.allowPing = mkOption { + default = false; + type = types.bool; + description = + '' + Whether to respond to incoming ICMP echo requests ("pings"). + ''; + }; + }; @@ -130,6 +139,12 @@ in # stuff like neighbor/router solicitation won't work. ip6tables -A INPUT -s fe80::/10 -p icmpv6 -j ACCEPT + # Optionally respond to pings. + ${optionalString cfg.allowPing '' + iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT + ip6tables -A INPUT -p icmpv6 --icmpv6-type echo-request -j ACCEPT + ''} + # Reject/drop everything else. ip46tables -A INPUT -j FW_REFUSE '';