this post was submitted on 01 Nov 2023
11 points (86.7% liked)

Nix / NixOS

1762 readers
12 users here now

Main links

Videos

founded 1 year ago
MODERATORS
erlingur@programming.dev
ballmerpeaking@programming.dev
WhiteBlackGoose@programming.dev
11
Are there alternatives for the NixOS firewall? (lemm.ee)
submitted 1 year ago* (last edited 1 year ago) by flashgnash@lemm.ee to c/nix@programming.dev
6 comments fedilink hide all child comments
 

I've found the built in nix firewall to be somewhat lacking (can't have different ports open on different networks for instance, I would rather reduce my attack surface while out on other people's/public WiFi)

Is it possible to use other firewall software on NixOS declaratively?

top 6 comments
sorted by: hot top controversial new old
[–] mikey@sh.itjust.works 11 points 1 year ago

You can disable the NixOS firewall, install firewalld (or any other firewall solution) and use that if you want.

[–] adamcstephens@lemmy.zip 0 points 1 year ago (2 children)

The nixos firewall can in fact be configured per interface. https://search.nixos.org/options?channel=23.05&show=networking.firewall.interfaces.%3Cname%3E.allowedTCPPorts&from=0&size=50&sort=relevance&type=packages&query=Networking.Firewall.Interfaces

[–] adamcstephens@lemmy.zip 1 points 1 year ago

Well if that link doesn’t work, networking.firewall.interfaces..allowedTCPPorts

[–] flashgnash@lemm.ee 0 points 1 year ago (1 children)

It can be configured per interface, but not per access point

This does actually help as I can just open ports over tailscale and exclusively use that for connections though the ideal is to be able to open ports only when connected to home WiFi

[–] moonpiedumplings@programming.dev 1 points 1 year ago* (last edited 1 year ago)

You want firewalld. Not declarative (probably?), but the only option that can dynamically change firewall rules based on the network you are connected to.

Look into firewalld zones.