dev/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

Merge pull request #310857 from rnhmjoj/pr-firewall

Browse Source 
nixos/firewall: fix reverse path check failures with IPsec
This commit is contained in:
Maciej Krüger 2024-08-25 15:06:49 +02:00 committed by GitHub
commit 00f536f650
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
nixos/modules/services/networking/firewall-iptables.nix
View File

@ -123,6 +123,9 @@ let
# Allows this host to act as a DHCP4 client without first having to use APIPA
iptables -t mangle -A nixos-fw-rpfilter -p udp --sport 67 --dport 68 -j RETURN
# Allows decrypted packets from an IPsec VPN
ip46tables -t mangle -A nixos-fw-rpfilter -m policy --dir in --pol ipsec -j RETURN
# Allows this host to act as a DHCPv4 server
iptables -t mangle -A nixos-fw-rpfilter -s 0.0.0.0 -d 255.255.255.255 -p udp --sport 68 --dport 67 -j RETURN

6
nixos/modules/services/networking/firewall-nftables.nix
View File

@ -82,6 +82,11 @@ in
}
];
networking.nftables.preCheckRuleset = ''
# can't validate IPsec rules
sed '/meta ipsec/d' -i ruleset.conf
'';
networking.nftables.tables."nixos-fw".family = "inet";
networking.nftables.tables."nixos-fw".content = ''
${optionalString (cfg.checkReversePath != false) ''
@ -89,6 +94,7 @@ in
type filter hook prerouting priority mangle + 10; policy drop;
meta nfproto ipv4 udp sport . udp dport { 67 . 68, 68 . 67 } accept comment "DHCPv4 client/server"
meta ipsec exists accept comment "decrypted packets from an IPsec VPN"
fib saddr . mark ${optionalString (cfg.checkReversePath != "loose") ". iif"} oif exists accept
jump rpfilter-allow