# Rules
Rules define what should happen with the trafiic matched by the zones.
Each rule has a list of `from` zones and `to` zones.
A rule only gets applied, if the traffic in question originated in one of the `from` zones and is heading to one of the `to` zones.

If matched, the rule can define ports to open, a terminating `verdict` or any custom `nft` rules by using `extraLines`.

Rules are applied from most specific to least specific, traversing the `from` side before the `to` side.
To allow for more complex setups (mostly custom drop/reject rules) rules are applied in multipe passes.
Each `rule` has a `ruleType`.
Rules are gruped by their type and applied in these groups, so that all rules are applied for the first type, before rules of the next type are taken into consideration.

## Options
### networking.nftables.firewall.rules

<div class="nixopt">

<div class="fieldname">Name</div>

```
networking.nftables.firewall.rules
```

<div class="fieldname">Description</div>

This option has no description.

<div class="fieldname">Type</div>

```
attribute set of (submodule)
```


<div class="fieldname">Default</div>

```
{ }
```





<div class="fieldname">Declared in</div>


<a href="https://github.com/thelegy/nixos-nftables-firewall/blob/main/modules/zoned.nix" target="_blank">modules/zoned.nix</a>



</div>


### networking.nftables.firewall.rules.&lt;name&gt;.after

<div class="nixopt">

<div class="fieldname">Name</div>

```
networking.nftables.firewall.rules.<name>.after
```

<div class="fieldname">Description</div>

This option has no description.

<div class="fieldname">Type</div>

```
non-empty (list of string)
```







<div class="fieldname">Declared in</div>


<a href="https://github.com/thelegy/nixos-nftables-firewall/blob/main/modules/zoned.nix" target="_blank">modules/zoned.nix</a>



</div>


### networking.nftables.firewall.rules.&lt;name&gt;.allowedTCPPortRanges

<div class="nixopt">

<div class="fieldname">Name</div>

```
networking.nftables.firewall.rules.<name>.allowedTCPPortRanges
```

<div class="fieldname">Description</div>

This option has no description.

<div class="fieldname">Type</div>

```
list of (submodule)
```


<div class="fieldname">Default</div>

```
[ ]
```


<div class="fieldname">Example</div>

```
[ { from = 1337; to = 1347; } ]
```



<div class="fieldname">Declared in</div>


<a href="https://github.com/thelegy/nixos-nftables-firewall/blob/main/modules/zoned.nix" target="_blank">modules/zoned.nix</a>



</div>


### networking.nftables.firewall.rules.&lt;name&gt;.allowedTCPPortRanges.*.from

<div class="nixopt">

<div class="fieldname">Name</div>

```
networking.nftables.firewall.rules.<name>.allowedTCPPortRanges.*.from
```

<div class="fieldname">Description</div>

This option has no description.

<div class="fieldname">Type</div>

```
16 bit unsigned integer; between 0 and 65535 (both inclusive)
```







<div class="fieldname">Declared in</div>


<a href="https://github.com/thelegy/nixos-nftables-firewall/blob/main/modules/zoned.nix" target="_blank">modules/zoned.nix</a>



</div>


### networking.nftables.firewall.rules.&lt;name&gt;.allowedTCPPortRanges.*.to

<div class="nixopt">

<div class="fieldname">Name</div>

```
networking.nftables.firewall.rules.<name>.allowedTCPPortRanges.*.to
```

<div class="fieldname">Description</div>

This option has no description.

<div class="fieldname">Type</div>

```
16 bit unsigned integer; between 0 and 65535 (both inclusive)
```







<div class="fieldname">Declared in</div>


<a href="https://github.com/thelegy/nixos-nftables-firewall/blob/main/modules/zoned.nix" target="_blank">modules/zoned.nix</a>



</div>


### networking.nftables.firewall.rules.&lt;name&gt;.allowedTCPPorts

<div class="nixopt">

<div class="fieldname">Name</div>

```
networking.nftables.firewall.rules.<name>.allowedTCPPorts
```

<div class="fieldname">Description</div>

This option has no description.

<div class="fieldname">Type</div>

```
list of signed integer
```


<div class="fieldname">Default</div>

```
[ ]
```





<div class="fieldname">Declared in</div>


<a href="https://github.com/thelegy/nixos-nftables-firewall/blob/main/modules/zoned.nix" target="_blank">modules/zoned.nix</a>



</div>


### networking.nftables.firewall.rules.&lt;name&gt;.allowedUDPPortRanges

<div class="nixopt">

<div class="fieldname">Name</div>

```
networking.nftables.firewall.rules.<name>.allowedUDPPortRanges
```

<div class="fieldname">Description</div>

This option has no description.

<div class="fieldname">Type</div>

```
list of (submodule)
```


<div class="fieldname">Default</div>

```
[ ]
```


<div class="fieldname">Example</div>

```
[ { from = 55000; to = 56000; } ]
```



<div class="fieldname">Declared in</div>


<a href="https://github.com/thelegy/nixos-nftables-firewall/blob/main/modules/zoned.nix" target="_blank">modules/zoned.nix</a>



</div>


### networking.nftables.firewall.rules.&lt;name&gt;.allowedUDPPortRanges.*.from

<div class="nixopt">

<div class="fieldname">Name</div>

```
networking.nftables.firewall.rules.<name>.allowedUDPPortRanges.*.from
```

<div class="fieldname">Description</div>

This option has no description.

<div class="fieldname">Type</div>

```
16 bit unsigned integer; between 0 and 65535 (both inclusive)
```







<div class="fieldname">Declared in</div>


<a href="https://github.com/thelegy/nixos-nftables-firewall/blob/main/modules/zoned.nix" target="_blank">modules/zoned.nix</a>



</div>


### networking.nftables.firewall.rules.&lt;name&gt;.allowedUDPPortRanges.*.to

<div class="nixopt">

<div class="fieldname">Name</div>

```
networking.nftables.firewall.rules.<name>.allowedUDPPortRanges.*.to
```

<div class="fieldname">Description</div>

This option has no description.

<div class="fieldname">Type</div>

```
16 bit unsigned integer; between 0 and 65535 (both inclusive)
```







<div class="fieldname">Declared in</div>


<a href="https://github.com/thelegy/nixos-nftables-firewall/blob/main/modules/zoned.nix" target="_blank">modules/zoned.nix</a>



</div>


### networking.nftables.firewall.rules.&lt;name&gt;.allowedUDPPorts

<div class="nixopt">

<div class="fieldname">Name</div>

```
networking.nftables.firewall.rules.<name>.allowedUDPPorts
```

<div class="fieldname">Description</div>

This option has no description.

<div class="fieldname">Type</div>

```
list of signed integer
```


<div class="fieldname">Default</div>

```
[ ]
```





<div class="fieldname">Declared in</div>


<a href="https://github.com/thelegy/nixos-nftables-firewall/blob/main/modules/zoned.nix" target="_blank">modules/zoned.nix</a>



</div>


### networking.nftables.firewall.rules.&lt;name&gt;.before

<div class="nixopt">

<div class="fieldname">Name</div>

```
networking.nftables.firewall.rules.<name>.before
```

<div class="fieldname">Description</div>

This option has no description.

<div class="fieldname">Type</div>

```
non-empty (list of string)
```







<div class="fieldname">Declared in</div>


<a href="https://github.com/thelegy/nixos-nftables-firewall/blob/main/modules/zoned.nix" target="_blank">modules/zoned.nix</a>



</div>


### networking.nftables.firewall.rules.&lt;name&gt;.early

<div class="nixopt">

<div class="fieldname">Name</div>

```
networking.nftables.firewall.rules.<name>.early
```

<div class="fieldname">Description</div>

This option has no description.

<div class="fieldname">Type</div>

```
boolean
```


<div class="fieldname">Default</div>

```
false
```





<div class="fieldname">Declared in</div>


<a href="https://github.com/thelegy/nixos-nftables-firewall/blob/main/modules/zoned.nix" target="_blank">modules/zoned.nix</a>



</div>


### networking.nftables.firewall.rules.&lt;name&gt;.enable

<div class="nixopt">

<div class="fieldname">Name</div>

```
networking.nftables.firewall.rules.<name>.enable
```

<div class="fieldname">Description</div>

This option has no description.

<div class="fieldname">Type</div>

```
boolean
```


<div class="fieldname">Default</div>

```
true
```





<div class="fieldname">Declared in</div>


<a href="https://github.com/thelegy/nixos-nftables-firewall/blob/main/modules/zoned.nix" target="_blank">modules/zoned.nix</a>



</div>


### networking.nftables.firewall.rules.&lt;name&gt;.extraLines

<div class="nixopt">

<div class="fieldname">Name</div>

```
networking.nftables.firewall.rules.<name>.extraLines
```

<div class="fieldname">Description</div>

This option has no description.

<div class="fieldname">Type</div>

```
list of string
```


<div class="fieldname">Default</div>

```
[ ]
```





<div class="fieldname">Declared in</div>


<a href="https://github.com/thelegy/nixos-nftables-firewall/blob/main/modules/zoned.nix" target="_blank">modules/zoned.nix</a>



</div>


### networking.nftables.firewall.rules.&lt;name&gt;.from

<div class="nixopt">

<div class="fieldname">Name</div>

```
networking.nftables.firewall.rules.<name>.from
```

<div class="fieldname">Description</div>

This option has no description.

<div class="fieldname">Type</div>

```
value "all" (singular enum) or list of string
```







<div class="fieldname">Declared in</div>


<a href="https://github.com/thelegy/nixos-nftables-firewall/blob/main/modules/zoned.nix" target="_blank">modules/zoned.nix</a>



</div>


### networking.nftables.firewall.rules.&lt;name&gt;.ignoreEmptyRule

<div class="nixopt">

<div class="fieldname">Name</div>

```
networking.nftables.firewall.rules.<name>.ignoreEmptyRule
```

<div class="fieldname">Description</div>

Usually rules without effect will fail the build.
Enable this switch to suppress the check for this rule.


<div class="fieldname">Type</div>

```
boolean
```


<div class="fieldname">Default</div>

```
false
```





<div class="fieldname">Declared in</div>


<a href="https://github.com/thelegy/nixos-nftables-firewall/blob/main/modules/zoned.nix" target="_blank">modules/zoned.nix</a>



</div>


### networking.nftables.firewall.rules.&lt;name&gt;.late

<div class="nixopt">

<div class="fieldname">Name</div>

```
networking.nftables.firewall.rules.<name>.late
```

<div class="fieldname">Description</div>

This option has no description.

<div class="fieldname">Type</div>

```
boolean
```


<div class="fieldname">Default</div>

```
false
```





<div class="fieldname">Declared in</div>


<a href="https://github.com/thelegy/nixos-nftables-firewall/blob/main/modules/zoned.nix" target="_blank">modules/zoned.nix</a>



</div>


### networking.nftables.firewall.rules.&lt;name&gt;.ruleType

<div class="nixopt">

<div class="fieldname">Name</div>

```
networking.nftables.firewall.rules.<name>.ruleType
```

<div class="fieldname">Description</div>

The type of the rule specifies when rules are applied.
The rules are applied in the following order:
`ban` then `rule` then `policy`

Usually most rules are of the type `rule`, the other types are mostly
intended to specify special drop/reject rules.


<div class="fieldname">Type</div>

```
one of "ban", "rule", "policy"
```


<div class="fieldname">Default</div>

```
"rule"
```





<div class="fieldname">Declared in</div>


<a href="https://github.com/thelegy/nixos-nftables-firewall/blob/main/modules/zoned.nix" target="_blank">modules/zoned.nix</a>



</div>


### networking.nftables.firewall.rules.&lt;name&gt;.to

<div class="nixopt">

<div class="fieldname">Name</div>

```
networking.nftables.firewall.rules.<name>.to
```

<div class="fieldname">Description</div>

This option has no description.

<div class="fieldname">Type</div>

```
value "all" (singular enum) or list of string
```







<div class="fieldname">Declared in</div>


<a href="https://github.com/thelegy/nixos-nftables-firewall/blob/main/modules/zoned.nix" target="_blank">modules/zoned.nix</a>



</div>


### networking.nftables.firewall.rules.&lt;name&gt;.verdict

<div class="nixopt">

<div class="fieldname">Name</div>

```
networking.nftables.firewall.rules.<name>.verdict
```

<div class="fieldname">Description</div>

This option has no description.

<div class="fieldname">Type</div>

```
null or one of "accept", "drop", "reject"
```


<div class="fieldname">Default</div>

```
null
```





<div class="fieldname">Declared in</div>


<a href="https://github.com/thelegy/nixos-nftables-firewall/blob/main/modules/zoned.nix" target="_blank">modules/zoned.nix</a>



</div>