ilyakooo0/nixpkgs
1
0
Fork 0
mirror of https://github.com/ilyakooo0/nixpkgs.git synced 2024-11-13 09:17:07 +03:00
Code Issues Projects Releases Wiki Activity

Merge pull request #75681 from lovesegfault/nixos-fix-nat

Browse Source 
nixos: fix ip46tables invocation in nat
This commit is contained in:
worldofpeace 2019-12-14 23:42:50 -05:00 committed by GitHub
commit 18571d6f0a
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 18 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
nixos/modules/services/networking/firewall.nix
View File

@ -42,16 +42,7 @@ let
kernelHasRPFilter = ((kernel.config.isEnabled or (x: false)) "IP_NF_MATCH_RPFILTER") || (kernel.features.netfilterRPFilter or false);
helpers =
''
# Helper command to manipulate both the IPv4 and IPv6 tables.
ip46tables() {
iptables -w "$@"
${optionalString config.networking.enableIPv6 ''
ip6tables -w "$@"
''}
}
'';
helpers = import ./helpers.nix { inherit config lib; };
writeShScript = name: text: let dir = pkgs.writeScriptBin name ''
#! ${pkgs.runtimeShell} -e
@ -271,7 +262,7 @@ let
apply = canonicalizePortList;
example = [ 22 80 ];
description =
''
''
List of TCP ports on which incoming connections are
accepted.
'';
@ -282,7 +273,7 @@ let
default = [ ];
example = [ { from = 8999; to = 9003; } ];
description =
''
''
A range of TCP ports on which incoming connections are
accepted.
'';

11
nixos/modules/services/networking/helpers.nix Normal file
View File

@ -0,0 +1,11 @@
{ config, lib, ... }: ''
# Helper command to manipulate both the IPv4 and IPv6 tables.
ip46tables() {
iptables -w "$@"
${
lib.optionalString config.networking.enableIPv6 ''
ip6tables -w "$@"
''
}
}
''

5
nixos/modules/services/networking/nat.nix
View File

@ -7,12 +7,14 @@
with lib;
let
cfg = config.networking.nat;
dest = if cfg.externalIP == null then "-j MASQUERADE" else "-j SNAT --to-source ${cfg.externalIP}";
helpers = import ./helpers.nix { inherit config lib; };
flushNat = ''
${helpers}
ip46tables -w -t nat -D PREROUTING -j nixos-nat-pre 2>/dev/null|| true
ip46tables -w -t nat -F nixos-nat-pre 2>/dev/null || true
ip46tables -w -t nat -X nixos-nat-pre 2>/dev/null || true
@ -27,6 +29,7 @@ let
'';
setupNat = ''
${helpers}
# Create subchain where we store rules
ip46tables -w -t nat -N nixos-nat-pre
ip46tables -w -t nat -N nixos-nat-post