movefasta/nixpkgs
0
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2025-07-13 21:50:33 +03:00
Code Activity

nixos/networkmanager: default firewallBackend to nftables, remove firewallBackend

Browse source 
Co-authored-by: Florian Klink <flokli@flokli.de>

Co-authored-by: Lin Jian <me@linj.tech>
This commit is contained in:
Sandro Jäckel 2023-07-01 16:10:20 +02:00 • committed by Maciej Krüger
parent ad0ca163e1
commit 9a85d77152
No known key found for this signature in database
GPG key ID: 0D948CE19CF49C5F
2 changed files with 3 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

13
nixos/modules/services/networking/networkmanager.nix
View file

@ -35,7 +35,6 @@ let
rc-manager = rc-manager =
if config.networking.resolvconf.enable then "resolvconf" if config.networking.resolvconf.enable then "resolvconf"
else "unmanaged"; else "unmanaged";
firewall-backend = cfg.firewallBackend;
}) })
(mkSection "keyfile" { (mkSection "keyfile" {
unmanaged-devices = unmanaged-devices =
@ -232,15 +231,6 @@ in
''; '';
}; };
firewallBackend = mkOption {
type = types.enum [ "iptables" "nftables" "none" ];
default = "iptables";
description = lib.mdDoc ''
Which firewall backend should be used for configuring masquerading with shared mode.
If set to none, NetworkManager doesn't manage the configuration at all.
'';
};
logLevel = mkOption { logLevel = mkOption {
type = types.enum [ "OFF" "ERR" "WARN" "INFO" "DEBUG" "TRACE" ]; type = types.enum [ "OFF" "ERR" "WARN" "INFO" "DEBUG" "TRACE" ];
default = "WARN"; default = "WARN";
@ -412,6 +402,9 @@ in
them via the DNS server in your network, or use environment.etc them via the DNS server in your network, or use environment.etc
to add a file into /etc/NetworkManager/dnsmasq.d reconfiguring hostsdir. to add a file into /etc/NetworkManager/dnsmasq.d reconfiguring hostsdir.
'') '')
(mkRemovedOptionModule [ "networking" "networkmanager" "firewallBackend" ] ''
This option was removed as NixOS is now using iptables-nftables-compat even when using iptables, therefore Networkmanager now uses the nftables backend unconditionally.
'')
]; ];

1
nixos/modules/services/networking/nftables.nix
View file

@ -248,7 +248,6 @@ in
config = mkIf cfg.enable { config = mkIf cfg.enable {
boot.blacklistedKernelModules = [ "ip_tables" ]; boot.blacklistedKernelModules = [ "ip_tables" ];
environment.systemPackages = [ pkgs.nftables ]; environment.systemPackages = [ pkgs.nftables ];
networking.networkmanager.firewallBackend = mkDefault "nftables";
# versionOlder for backportability, remove afterwards # versionOlder for backportability, remove afterwards
networking.nftables.flushRuleset = mkDefault (versionOlder config.system.stateVersion "23.11" || (cfg.rulesetFile != null || cfg.ruleset != "")); networking.nftables.flushRuleset = mkDefault (versionOlder config.system.stateVersion "23.11" || (cfg.rulesetFile != null || cfg.ruleset != ""));
systemd.services.nftables = { systemd.services.nftables = {