search

thelegy / nixos-nftables-firewall

A zone based firewall built ontop of nftables for nixos
https://thelegy.github.io/nixos-nftables-firewall/
MIT License
39 stars 5 forks source link

checkScript replicates NixOS/nixpkgs#88643 #8

Open antifuchs opened 1 year ago

antifuchs commented 1 year ago

I'm trying the zoned nixos-nftables-firewall for the first time & love the ways it lets me express stuff! Unfortunately, I'm running into the same issue as was fixed in NixOS/nixpkgs#121517: When I try to start the nftables firewall after tailscale (which installs iptables-nft rules via the nftables compatibility layer) has been loaded, you get the following error:

Aug 14 01:46:33 leigh systemd[1]: Starting nftables firewall...
Aug 14 01:46:33 leigh qzsaxdqhprfbdvy0vrpj4scgfrp315v6-nftables-stopcheck[50009]: Unload ip_tables before using nftables!
Aug 14 01:46:33 leigh birsnyjrwv4wsd1lwhdfq27wlv9rcybd-nftables-check[50015]: Unload ip_tables before using nftables!
Aug 14 01:46:33 leigh systemd[1]: nftables.service: Main process exited, code=exited, status=1/FAILURE
Aug 14 01:46:33 leigh systemd[1]: nftables.service: Failed with result 'exit-code'.
Aug 14 01:46:33 leigh systemd[1]: Failed to start nftables firewall.

I think the fix from the PR linked above would be appropriate for this flake, as well: Remove the warning, as iptables and nft can now work together.

What do you think?

thelegy commented 1 year ago

Thanks for the hint. As the implementation was based on the file in nixpkgs that was changed by the PR you referenced, it makes sense to also replicate the changes in this repository.

In fact it only is replicated in this repository as I added the stopRuleset that is executed when the systemd unit is stopped or fails. I think it is a good addition, as firewalls can be more robust that way and wont fail-open. It might be the part of this repository that could even be included in upstream nixpkgs. But until it is I will replicate those changes in this repository.

For tailscale I might have an additional hint. I never liked the idea of it messing with my finely crafted firewall rules. You can actiually tell it not to bother. I have a custum tailscale module that aims to lock down tailscale much more at the expense of some features of it not working properly like tailscale-ssh and exit nodes, which I never use. Maybe that is of interest to you: https://github.com/thelegy/yaner/blob/main/modules/tailscale.nix

antifuchs commented 2 months ago

I finally realized that I hadn't made a pull request for this code change, which I'd been using for nearly a year now. Hope you can include it!