Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Disable networking.firewall by default #12957

Closed
wants to merge 2 commits into from
Closed

Disable networking.firewall by default #12957

wants to merge 2 commits into from

Commits on Feb 12, 2016

  1. nixos-generate-config: Add enabling the firewall 

    As we're going to turn it off by default, so this will make it easier
for new and not so savvy users to not open random ports to the outside
world.

Signed-off-by: aszlig <[email protected]>
    @aszlig
    aszlig committed Feb 12, 2016
    Configuration menu
    Copy the full SHA
    8d1a8a3 View commit details
    Browse the repository at this point in the history

  2. nixos/firewall: Disable it by default for >= 16.03 

    The reason for disabling the "firewall" (let's call it just netfilter,
shall we?) is that we already have a way to declaratively specify which
services we want to run.

So we really should *only* run the services that we care for and not
introduce additional attack vectors by adding netfilter modules to the
kernel (especially the conntrack modules had security flaws in the
past).

We should also better focus on making the service modules more
configurable and by default listen to only the ports that are
*necessary* to run the service.

As with everything else, the NixOS configuration ultimately should
represent the stuff the user *wants* to have and *only* that.

Signed-off-by: aszlig <[email protected]>
    @aszlig
    aszlig committed Feb 12, 2016
    Configuration menu
    Copy the full SHA
    eedd497 View commit details
    Browse the repository at this point in the history