Mic92/stockholm
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

l 3 iptables: set defaults correctly

Browse Source
This commit is contained in:
lassulus 2016-11-28 13:06:00 +01:00
parent 0ae17234e3
commit ca1d6b3588
1 changed files with 5 additions and 25 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

30
krebs/3modules/iptables.nix
View File

@ -29,9 +29,10 @@ let
tables = mkOption {
type = with types; attrsOf (attrsOf (submodule ({
options = {
#TODO: find out good defaults.
policy = mkOption {
type = str;
default = "-";
default = "ACCEPT";
};
rules = mkOption {
type = nullOr (listOf (submodule ({
@ -133,30 +134,9 @@ let
#=====
rules = iptables-version:
let
#TODO: find out good defaults.
tables-defaults = {
nat.PREROUTING.policy = "ACCEPT";
nat.INPUT.policy = "ACCEPT";
nat.OUTPUT.policy = "ACCEPT";
nat.POSTROUTING.policy = "ACCEPT";
filter.INPUT.policy = "ACCEPT";
filter.FORWARD.policy = "ACCEPT";
filter.OUTPUT.policy = "ACCEPT";
#if someone specifies any other rules on this chain, the default rules get lost.
#is this wanted beahiviour or a bug?
#TODO: implement abstraction of rules
filter.INPUT.rules = [
{ predicate = "-m conntrack --ctstate RELATED,ESTABLISHED"; target = "ACCEPT"; }
];
};
tables = tables-defaults // cfg.tables;
in
pkgs.writeText "krebs-iptables-rules${iptables-version}" ''
${buildTables iptables-version tables}
'';
pkgs.writeText "krebs-iptables-rules${iptables-version}" ''
${buildTables iptables-version cfg.tables}
'';
startScript = pkgs.writeDash "krebs-iptables_start" ''
set -euf