5 commits

Author	SHA1	Message	Date
rnhmjoj	3c12ef3f21	nixos/firewall: fix reverse path check failures with IPsec ... The endpoint of an IPsec tunnel receives encrypted IPsec packets that are first decrypted and then forwarded to the intended destination. The decrypted traffic appears to originate from the same interface it came in from, so in most cases these packets will fail the reverse path check even if legitimate. This change adds an exception to not reject packets that were previously IPsec-encrypted, meaning the have been accepted, decrypted and are in the process of being forwarded to their final destinal. Sources: - https://www.kernel.org/doc/Documentation/networking/xfrm_device.txt - https://git.netfilter.org/nftables/commit/?id=49f6e9a846c6c8325b95debe04d5ebc3c01246fb - https://git.netfilter.org/nftables/commit/?id=8f55ed41d007061bd8aae94fee2bda172c0e8996 - https://thermalcircle.de/doku.php?id=blog:linux:nftables_demystifying_ipsec_expressions	2024-06-05 15:18:35 +02:00
stuebinm	6afb255d97	nixos: remove all uses of lib.mdDoc ... these changes were generated with nixq 0.0.2, by running nixq ">> lib.mdDoc[remove] Argument[keep]" --batchmode nixos/**.nix nixq ">> mdDoc[remove] Argument[keep]" --batchmode nixos/**.nix nixq ">> Inherit >> mdDoc[remove]" --batchmode nixos/**.nix two mentions of the mdDoc function remain in nixos/, both of which are inside of comments. Since lib.mdDoc is already defined as just id, this commit is a no-op as far as Nix (and the built manual) is concerned.	2024-04-13 10:07:35 -07:00
Philip Taron	5ab8a128de	nixos/firewall-iptables: ensure correct ordering w.r.t. shutdown.target	2023-11-30 15:07:03 -08:00
Janik H.	fa9cdc83ab	nixos/firewall: install nixos-firewall-tool for iptables by default	2023-11-18 17:08:30 +01:00
Rvfg	a43c7b2a70	nixos/{firewall, nat}: add a nftables based implementation	2022-12-23 00:49:24 +08:00