movefasta/nixpkgs
0
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2025-07-13 21:50:33 +03:00
Code Activity

Merge pull request #310857 from rnhmjoj/pr-firewall

Browse source 
nixos/firewall: fix reverse path check failures with IPsec
This commit is contained in:
Maciej Krüger 2024-08-25 15:06:49 +02:00 • committed by GitHub
commit 00f536f650
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 9 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

3
nixos/modules/services/networking/firewall-iptables.nix
View file

@ -123,6 +123,9 @@ let
# Allows this host to act as a DHCP4 client without first having to use APIPA # Allows this host to act as a DHCP4 client without first having to use APIPA
iptables -t mangle -A nixos-fw-rpfilter -p udp --sport 67 --dport 68 -j RETURN iptables -t mangle -A nixos-fw-rpfilter -p udp --sport 67 --dport 68 -j RETURN
# Allows decrypted packets from an IPsec VPN
ip46tables -t mangle -A nixos-fw-rpfilter -m policy --dir in --pol ipsec -j RETURN
# Allows this host to act as a DHCPv4 server # Allows this host to act as a DHCPv4 server
iptables -t mangle -A nixos-fw-rpfilter -s 0.0.0.0 -d 255.255.255.255 -p udp --sport 68 --dport 67 -j RETURN iptables -t mangle -A nixos-fw-rpfilter -s 0.0.0.0 -d 255.255.255.255 -p udp --sport 68 --dport 67 -j RETURN

6
nixos/modules/services/networking/firewall-nftables.nix
View file

@ -82,6 +82,11 @@ in
} }
]; ];
networking.nftables.preCheckRuleset = ''
# can't validate IPsec rules
sed '/meta ipsec/d' -i ruleset.conf
'';
networking.nftables.tables."nixos-fw".family = "inet"; networking.nftables.tables."nixos-fw".family = "inet";
networking.nftables.tables."nixos-fw".content = '' networking.nftables.tables."nixos-fw".content = ''
${optionalString (cfg.checkReversePath != false) '' ${optionalString (cfg.checkReversePath != false) ''
@ -89,6 +94,7 @@ in
type filter hook prerouting priority mangle + 10; policy drop; type filter hook prerouting priority mangle + 10; policy drop;
meta nfproto ipv4 udp sport . udp dport { 67 . 68, 68 . 67 } accept comment "DHCPv4 client/server" meta nfproto ipv4 udp sport . udp dport { 67 . 68, 68 . 67 } accept comment "DHCPv4 client/server"
meta ipsec exists accept comment "decrypted packets from an IPsec VPN"
fib saddr . mark ${optionalString (cfg.checkReversePath != "loose") ". iif"} oif exists accept fib saddr . mark ${optionalString (cfg.checkReversePath != "loose") ". iif"} oif exists accept
jump rpfilter-allow jump rpfilter-allow