nixos-nftables-firewall

Docs are available!

This collection of nix modules provides a firewall for NixOS machines. This firewall utilizes nftables and uses network zones.

To get started have a look at the Quickstart guide.

Table of contents

• Quickstart guide
  • Installation of the module
  • Using the module
    • Zones
    • Rules
• Chains
  • Options
    • networking.nftables.chains
    • networking.nftables.chains.<name>.<name>.after
    • networking.nftables.chains.<name>.<name>.before
    • networking.nftables.chains.<name>.<name>.early
    • networking.nftables.chains.<name>.<name>.enable
    • networking.nftables.chains.<name>.<name>.late
    • networking.nftables.chains.<name>.<name>.rules
    • networking.nftables.chains.<name>.<name>.rules.*.chainDependencies
    • networking.nftables.chains.<name>.<name>.rules.*.goto
    • networking.nftables.chains.<name>.<name>.rules.*.inlinable
    • networking.nftables.chains.<name>.<name>.rules.*.jump
    • networking.nftables.chains.<name>.<name>.rules.*.onExpression
    • networking.nftables.chains.<name>.<name>.rules.*.text
    • networking.nftables.requiredChains
• Common options
  • Options
    • networking.nftables.firewall.enable
    • networking.nftables.firewall.localZoneName
    • networking.nftables.stopRuleset
    • networking.nftables.stopRulesetFile
• Rules
  • Options
    • networking.nftables.firewall.rules
    • networking.nftables.firewall.rules.<name>.after
    • networking.nftables.firewall.rules.<name>.allowedTCPPortRanges
    • networking.nftables.firewall.rules.<name>.allowedTCPPortRanges.*.from
    • networking.nftables.firewall.rules.<name>.allowedTCPPortRanges.*.to
    • networking.nftables.firewall.rules.<name>.allowedTCPPorts
    • networking.nftables.firewall.rules.<name>.allowedUDPPortRanges
    • networking.nftables.firewall.rules.<name>.allowedUDPPortRanges.*.from
    • networking.nftables.firewall.rules.<name>.allowedUDPPortRanges.*.to
    • networking.nftables.firewall.rules.<name>.allowedUDPPorts
    • networking.nftables.firewall.rules.<name>.before
    • networking.nftables.firewall.rules.<name>.early
    • networking.nftables.firewall.rules.<name>.enable
    • networking.nftables.firewall.rules.<name>.extraLines
    • networking.nftables.firewall.rules.<name>.from
    • networking.nftables.firewall.rules.<name>.ignoreEmptyRule
    • networking.nftables.firewall.rules.<name>.late
    • networking.nftables.firewall.rules.<name>.ruleType
    • networking.nftables.firewall.rules.<name>.to
    • networking.nftables.firewall.rules.<name>.verdict
• Snippets
  • nnf-common
    • networking.nftables.firewall.snippets.nnf-common.enable
  • nnf-default-stopRuleset
    • networking.nftables.firewall.snippets.nnf-default-stopRuleset.allowedTCPPorts
    • networking.nftables.firewall.snippets.nnf-default-stopRuleset.enable
  • nnf-conntrack
    • networking.nftables.firewall.snippets.nnf-conntrack.enable
  • nnf-dhcpv6
    • networking.nftables.firewall.snippets.nnf-dhcpv6.enable
  • nnf-drop
    • networking.nftables.firewall.snippets.nnf-drop.enable
  • nnf-icmp
    • networking.nftables.firewall.snippets.nnf-icmp.enable
    • networking.nftables.firewall.snippets.nnf-icmp.ipv4Types
    • networking.nftables.firewall.snippets.nnf-icmp.ipv6Types
  • nnf-loopback
    • networking.nftables.firewall.snippets.nnf-loopback.enable
  • nnf-nixos-firewall
    • networking.nftables.firewall.snippets.nnf-nixos-firewall.enable
  • nnf-ssh
    • networking.nftables.firewall.snippets.nnf-ssh.enable
• Zones
  • Options
    • networking.nftables.firewall.zones
    • networking.nftables.firewall.zones.<name>.after
    • networking.nftables.firewall.zones.<name>.before
    • networking.nftables.firewall.zones.<name>.early
    • networking.nftables.firewall.zones.<name>.egressExpression
    • networking.nftables.firewall.zones.<name>.enable
    • networking.nftables.firewall.zones.<name>.ingressExpression
    • networking.nftables.firewall.zones.<name>.interfaces
    • networking.nftables.firewall.zones.<name>.ipv4Addresses
    • networking.nftables.firewall.zones.<name>.ipv6Addresses
    • networking.nftables.firewall.zones.<name>.late
    • networking.nftables.firewall.zones.<name>.parent