# Zones
Zones define a part of network topology.
They are usually defined as a list of subnets or by a list of interfaces, though custom rules for matching traffic are possible.
There exists an implicit `all` Zone, that matches all traffic.
Traffic originating or targeting the local machine are matched by a predefined zone called `fw` (short for firewall) by default.

There exists inheritance for zones.
Each zone will automatically get the rules of its parent zone applied, after the more specific rules get applied.

## Options
### networking.nftables.firewall.zones

<div class="nixopt">

<div class="fieldname">Name</div>

```
networking.nftables.firewall.zones
```

<div class="fieldname">Description</div>

This option has no description.

<div class="fieldname">Type</div>

```
attribute set of (submodule)
```







<div class="fieldname">Declared in</div>


<a href="https://github.com/thelegy/nixos-nftables-firewall/blob/main/modules/zoned.nix" target="_blank">modules/zoned.nix</a>



</div>


### networking.nftables.firewall.zones.&lt;name&gt;.after

<div class="nixopt">

<div class="fieldname">Name</div>

```
networking.nftables.firewall.zones.<name>.after
```

<div class="fieldname">Description</div>

This option has no description.

<div class="fieldname">Type</div>

```
non-empty (list of string)
```







<div class="fieldname">Declared in</div>


<a href="https://github.com/thelegy/nixos-nftables-firewall/blob/main/modules/zoned.nix" target="_blank">modules/zoned.nix</a>



</div>


### networking.nftables.firewall.zones.&lt;name&gt;.before

<div class="nixopt">

<div class="fieldname">Name</div>

```
networking.nftables.firewall.zones.<name>.before
```

<div class="fieldname">Description</div>

This option has no description.

<div class="fieldname">Type</div>

```
non-empty (list of string)
```







<div class="fieldname">Declared in</div>


<a href="https://github.com/thelegy/nixos-nftables-firewall/blob/main/modules/zoned.nix" target="_blank">modules/zoned.nix</a>



</div>


### networking.nftables.firewall.zones.&lt;name&gt;.early

<div class="nixopt">

<div class="fieldname">Name</div>

```
networking.nftables.firewall.zones.<name>.early
```

<div class="fieldname">Description</div>

This option has no description.

<div class="fieldname">Type</div>

```
boolean
```


<div class="fieldname">Default</div>

```
false
```





<div class="fieldname">Declared in</div>


<a href="https://github.com/thelegy/nixos-nftables-firewall/blob/main/modules/zoned.nix" target="_blank">modules/zoned.nix</a>



</div>


### networking.nftables.firewall.zones.&lt;name&gt;.egressExpression

<div class="nixopt">

<div class="fieldname">Name</div>

```
networking.nftables.firewall.zones.<name>.egressExpression
```

<div class="fieldname">Description</div>

`ingressExpression` and `egressExpression` contain nft-espressions
to match traffic, that defines the zone. Traffic matched by the
`ingressExpression` is considered originating in the zone, while
traffic matched by the `egressExpression` is considered targeting
the zone.

If multiple expressions are given, any one of them matching traffic
suffices to consider the traffic as part of the zone. This is used
eg. when defining a zone as an ipv4 and ipv6 subnet. No Traffic
will ever match both, so one matching expression is considered
sufficient.

`ingressExpression` and `egressExpression` must be balanced, i.e.
both lists need to contain the same number of expressions.

`ingressExpression` and `egressExpression` are mandatory for all
zones except the local zone.


<div class="fieldname">Type</div>

```
list of string
```


<div class="fieldname">Default</div>

```
[ ]
```





<div class="fieldname">Declared in</div>


<a href="https://github.com/thelegy/nixos-nftables-firewall/blob/main/modules/zoned.nix" target="_blank">modules/zoned.nix</a>



</div>


### networking.nftables.firewall.zones.&lt;name&gt;.enable

<div class="nixopt">

<div class="fieldname">Name</div>

```
networking.nftables.firewall.zones.<name>.enable
```

<div class="fieldname">Description</div>

This option has no description.

<div class="fieldname">Type</div>

```
boolean
```


<div class="fieldname">Default</div>

```
true
```





<div class="fieldname">Declared in</div>


<a href="https://github.com/thelegy/nixos-nftables-firewall/blob/main/modules/zoned.nix" target="_blank">modules/zoned.nix</a>



</div>


### networking.nftables.firewall.zones.&lt;name&gt;.ingressExpression

<div class="nixopt">

<div class="fieldname">Name</div>

```
networking.nftables.firewall.zones.<name>.ingressExpression
```

<div class="fieldname">Description</div>

`ingressExpression` and `egressExpression` contain nft-espressions
to match traffic, that defines the zone. Traffic matched by the
`ingressExpression` is considered originating in the zone, while
traffic matched by the `egressExpression` is considered targeting
the zone.

If multiple expressions are given, any one of them matching traffic
suffices to consider the traffic as part of the zone. This is used
eg. when defining a zone as an ipv4 and ipv6 subnet. No Traffic
will ever match both, so one matching expression is considered
sufficient.

`ingressExpression` and `egressExpression` must be balanced, i.e.
both lists need to contain the same number of expressions.

`ingressExpression` and `egressExpression` are mandatory for all
zones except the local zone.


<div class="fieldname">Type</div>

```
list of string
```


<div class="fieldname">Default</div>

```
[ ]
```





<div class="fieldname">Declared in</div>


<a href="https://github.com/thelegy/nixos-nftables-firewall/blob/main/modules/zoned.nix" target="_blank">modules/zoned.nix</a>



</div>


### networking.nftables.firewall.zones.&lt;name&gt;.interfaces

<div class="nixopt">

<div class="fieldname">Name</div>

```
networking.nftables.firewall.zones.<name>.interfaces
```

<div class="fieldname">Description</div>

Shorthand for defining `ingressExpression` and `egressExpression`
using `iifname` and `oifname` respectively.

This defines the zone as a list of network interfaces.


<div class="fieldname">Type</div>

```
list of string
```


<div class="fieldname">Default</div>

```
[ ]
```


<div class="fieldname">Example</div>

```
[ "eth0" ]
```



<div class="fieldname">Declared in</div>


<a href="https://github.com/thelegy/nixos-nftables-firewall/blob/main/modules/zoned.nix" target="_blank">modules/zoned.nix</a>



</div>


### networking.nftables.firewall.zones.&lt;name&gt;.ipv4Addresses

<div class="nixopt">

<div class="fieldname">Name</div>

```
networking.nftables.firewall.zones.<name>.ipv4Addresses
```

<div class="fieldname">Description</div>

Shorthand for defining `ingressExpression` and `egressExpression`
using `ip saddr` and `ip daddr` respectively.

This defines the zone as a list of ipv4 hosts or subnets.


<div class="fieldname">Type</div>

```
list of string
```


<div class="fieldname">Default</div>

```
[ ]
```


<div class="fieldname">Example</div>

```
[ "192.168.0.0/24" ]
```



<div class="fieldname">Declared in</div>


<a href="https://github.com/thelegy/nixos-nftables-firewall/blob/main/modules/zoned.nix" target="_blank">modules/zoned.nix</a>



</div>


### networking.nftables.firewall.zones.&lt;name&gt;.ipv6Addresses

<div class="nixopt">

<div class="fieldname">Name</div>

```
networking.nftables.firewall.zones.<name>.ipv6Addresses
```

<div class="fieldname">Description</div>

Shorthand for defining `ingressExpression` and `egressExpression`
using `ip6 saddr` and `ip6 daddr` respectively.

This defines the zone as a list of ipv6 hosts or subnets.


<div class="fieldname">Type</div>

```
list of string
```


<div class="fieldname">Default</div>

```
[ ]
```


<div class="fieldname">Example</div>

```
[ "2042::/16" ]
```



<div class="fieldname">Declared in</div>


<a href="https://github.com/thelegy/nixos-nftables-firewall/blob/main/modules/zoned.nix" target="_blank">modules/zoned.nix</a>



</div>


### networking.nftables.firewall.zones.&lt;name&gt;.late

<div class="nixopt">

<div class="fieldname">Name</div>

```
networking.nftables.firewall.zones.<name>.late
```

<div class="fieldname">Description</div>

This option has no description.

<div class="fieldname">Type</div>

```
boolean
```


<div class="fieldname">Default</div>

```
false
```





<div class="fieldname">Declared in</div>


<a href="https://github.com/thelegy/nixos-nftables-firewall/blob/main/modules/zoned.nix" target="_blank">modules/zoned.nix</a>



</div>


### networking.nftables.firewall.zones.&lt;name&gt;.parent

<div class="nixopt">

<div class="fieldname">Name</div>

```
networking.nftables.firewall.zones.<name>.parent
```

<div class="fieldname">Description</div>

Additionally to `ingressExpression` and `egressExpression` zones
can also be defined as a subzone of another zone. If so, traffic
is matched only against the `ingressExpression` and
`egressExpression`, if the traffic is already considered to be
part of the parent zone.

If traffic matches a zone, it will first be tested, if it also
matches some of its subzones. If so, the logic of the subzones
will be called. If not, or if the subzones did not terminate the
rule processing with a verdict, the rules of the parent zone will
be applied.


<div class="fieldname">Type</div>

```
null or string
```


<div class="fieldname">Default</div>

```
null
```


<div class="fieldname">Example</div>

```
config.networking.nftables.firewall.localZoneName
```



<div class="fieldname">Declared in</div>


<a href="https://github.com/thelegy/nixos-nftables-firewall/blob/main/modules/zoned.nix" target="_blank">modules/zoned.nix</a>



</div>