ilyakooo0/nixpkgs
1
0
Fork 0
mirror of https://github.com/ilyakooo0/nixpkgs.git synced 2024-12-29 06:45:54 +03:00
Code Issues Projects Releases Wiki Activity

nat: always flush nixos nat rules on firewall start/reload

Browse Source 
Fixes #27510
This commit is contained in:
Markus Mueller 2017-08-03 17:41:07 +00:00 committed by Robin Gloster
parent d604336b5b
commit 53d2f0980d
No known key found for this signature in database
GPG Key ID: 5E4C836C632C2882
1 changed files with 32 additions and 29 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

61
nixos/modules/services/networking/nat.nix
View File

@ -151,38 +151,41 @@ in
###### implementation ###### implementation
config = mkIf config.networking.nat.enable { config = mkMerge [
{ networking.firewall.extraCommands = mkBefore flushNat; }
(mkIf config.networking.nat.enable {
environment.systemPackages = [ pkgs.iptables ]; environment.systemPackages = [ pkgs.iptables ];
boot = { boot = {
kernelModules = [ "nf_nat_ftp" ]; kernelModules = [ "nf_nat_ftp" ];
kernel.sysctl = { kernel.sysctl = {
"net.ipv4.conf.all.forwarding" = mkOverride 99 true; "net.ipv4.conf.all.forwarding" = mkOverride 99 true;
"net.ipv4.conf.default.forwarding" = mkOverride 99 true; "net.ipv4.conf.default.forwarding" = mkOverride 99 true;
}; };
};
networking.firewall = mkIf config.networking.firewall.enable {
extraCommands = mkMerge [ (mkBefore flushNat) setupNat ];
extraStopCommands = flushNat;
};
systemd.services = mkIf (!config.networking.firewall.enable) { nat = {
description = "Network Address Translation";
wantedBy = [ "network.target" ];
after = [ "network-pre.target" "systemd-modules-load.service" ];
path = [ pkgs.iptables ];
unitConfig.ConditionCapability = "CAP_NET_ADMIN";
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
}; };
script = flushNat + setupNat; networking.firewall = mkIf config.networking.firewall.enable {
extraCommands = setupNat;
extraStopCommands = flushNat;
};
postStop = flushNat; systemd.services = mkIf (!config.networking.firewall.enable) { nat = {
}; }; description = "Network Address Translation";
}; wantedBy = [ "network.target" ];
after = [ "network-pre.target" "systemd-modules-load.service" ];
path = [ pkgs.iptables ];
unitConfig.ConditionCapability = "CAP_NET_ADMIN";
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
};
script = flushNat + setupNat;
postStop = flushNat;
}; };
})
];
} }