Commit graph

18 commits

Author SHA1 Message Date
Joachim Fasting 7023e03d77 firewall service: fix pingLimit example value
The example uses single dashes, whereas iptables requires double dashes.
2015-01-20 08:47:11 +01:00
Vladimír Čunát 61d9f06760 fix a typo from 2627198b0c 2014-12-28 10:44:50 +01:00
William A. Kennington III 2627198b0c nixos/firewall: Add ipset utility 2014-12-28 00:04:49 -08:00
William A. Kennington III 8a94c06595 nixos: Add network-pre.target and adjust firewall start ordering 2014-12-01 17:19:44 -08:00
Boris Sukholitko 53b24d0c95 firewall: clear rpfilter on stop 2014-11-14 09:07:18 +02:00
William A. Kennington III ec9c4143a7 nixos/firewall: Cleanup in case reload fails 2014-09-16 15:51:57 -07:00
William A. Kennington III 6a43d51291 nixos/firewall: Support extraStopCommands 2014-09-15 21:31:26 -07:00
William A. Kennington III fd7b9b4291 nixos/firewall: Don't allow traffic during reload 2014-09-15 20:40:16 -07:00
Eelco Dolstra 0a256cc0ee Firewall: Only start if we have CAP_NET_ADMIN 2014-04-19 23:02:59 +02:00
Eelco Dolstra 8dcf76480c firewall: Order after systemd-modules-load.service
This ensures that connection tracking modules are loaded on time.
2014-04-17 18:10:20 +02:00
Eelco Dolstra 29027fd1e1 Rewrite ‘with pkgs.lib’ -> ‘with lib’
Using pkgs.lib on the spine of module evaluation is problematic
because the pkgs argument depends on the result of module
evaluation. To prevent an infinite recursion, pkgs and some of the
modules are evaluated twice, which is inefficient. Using ‘with lib’
prevents this problem.
2014-04-14 16:26:48 +02:00
Eelco Dolstra 017408e048 Use iptables' ‘-w’ flag
This prevents errors like "Another app is currently holding the
xtables lock" if the firewall and NAT services are starting in
parallel.  (Longer term, we should probably move to a single service
for managing the iptables rules.)
2014-04-11 17:16:44 +02:00
Eelco Dolstra 694cc6172a Enable the firewall by default
Fixes #2135.
2014-04-08 09:44:01 +02:00
Shea Levy a0d574f19b firewall: Allow setting rate limits for pings 2014-03-14 14:55:30 -04:00
Austin Seipp fc9022bea1 firewall: add support for TCP/UDP port ranges
This is useful for packages like mosh, which use a wide UDP port range
by default for incoming connections.

Signed-off-by: Austin Seipp <aseipp@pobox.com>
2014-02-22 18:19:22 +01:00
Eelco Dolstra c1159edc65 Remove remaining references to Upstart 2013-10-31 13:26:06 +01:00
Eelco Dolstra 408b8b5725 Add lots of missing option types 2013-10-30 18:47:43 +01:00
Eelco Dolstra 5c1f8cbc70 Move all of NixOS to nixos/ in preparation of the repository merge 2013-10-10 13:28:20 +02:00
Renamed from modules/services/networking/firewall.nix (Browse further)