nixos/firewall: Add ipset utility

This commit is contained in:
William A. Kennington III 2014-12-28 00:04:49 -08:00
parent c17fda769a
commit 2627198b0c

View file

@ -443,7 +443,7 @@ in
networking.firewall.trustedInterfaces = [ "lo" ];
environment.systemPackages = [ pkgs.iptables ];
environment.systemPackages = [ pkgs.iptables pkgs.ipset ];
boot.kernelModules = map (x: "nf_conntrack_${x}") cfg.connectionTrackingModules;
boot.extraModprobeConfig = optionalString (!cfg.autoLoadConntrackHelpers) ''
@ -462,7 +462,7 @@ in
before = [ "network-pre.target" ];
after = [ "systemd-modules-load.service" ];
path = [ pkgs.iptables ];
path = [ pkgs.iptables pkg.ipset ];
# FIXME: this module may also try to load kernel modules, but
# containers don't have CAP_SYS_MODULE. So the host system had