I've wanted to for years. I've tried to multiple times. Like I love computers and programming I can get absolutely lost in code for hours. For whatever reason when I start to look at networking my brain switches off and says nope. I can clean enough to hack what I need for the most part, but of I strive for any depth of knowledge on the subject my brain shuts down.
networking.firewall.enable = true;
::: spoiler Tap for spoiler
Yeah I'm familiar with all the tools but - omg - have NixOS modules ever changed my life
:::
The beauty is that this, or your own custom modules, become a declarative and reproducible abstraction layer which (if properly written) lets you focus on the what rather than the how.
... You could also write a bunch of scripts, which is what I used to do before I joined the cult.
Nftables rulesets are reproducible and let you focus on what rather than how. I've tried nix some time ago, conceptually cool distro, but it requires a lot of time, time that can be used configuring emacs 😝.
On all modern linux's, the iptables command is actually a compatibility layer controlling nftables.
I prefer it over the nft command because it's much easier to read and use. I only use the nft command when checking for the occasional chain/table that iptables didn't show me.
10 Comments
Nester@feddit.uk · 14 pts · 22d
I didn't realise I wanted to read up about Linux firewalls, but apparently I did. Thanks
BeardedGingerWonder@feddit.uk · 3 pts · 22d
I've wanted to for years. I've tried to multiple times. Like I love computers and programming I can get absolutely lost in code for hours. For whatever reason when I start to look at networking my brain switches off and says nope. I can clean enough to hack what I need for the most part, but of I strive for any depth of knowledge on the subject my brain shuts down.
Hoping this article is the ticket.
ImgurRefugee114@reddthat.com · 8 pts · 22d
networking.firewall.enable = true;::: spoiler Tap for spoiler Yeah I'm familiar with all the tools but - omg - have NixOS modules ever changed my life :::esc@piefed.social · 3 pts · 22d
What does it do?
Gregers@lemmy.world · 8 pts · 22d
Deletes /dev/null obviously
esc@piefed.social · 3 pts · 22d
For me it's clearly not obvious what exactly 'enabling firewall' entails, what policy is applied, what rules, etc., etc.
ImgurRefugee114@reddthat.com · 3 pts · 22d
There are sensible defaults but it ultimately depends on what the module is doing and how you configure it.
https://github.com/NixOS/nixpkgs/blob/8c91a71d13451abc40eb9dae8910f972f979852f/nixos/modules/services/networking/firewall.nix
The beauty is that this, or your own custom modules, become a declarative and reproducible abstraction layer which (if properly written) lets you focus on the what rather than the how.
... You could also write a bunch of scripts, which is what I used to do before I joined the cult.
esc@piefed.social · 3 pts · 21d
Nftables rulesets are reproducible and let you focus on what rather than how. I've tried nix some time ago, conceptually cool distro, but it requires a lot of time, time that can be used configuring emacs 😝.
moonpiedumplings@programming.dev · 6 pts · 22d
On all modern linux's, the iptables command is actually a compatibility layer controlling nftables.
I prefer it over the nft command because it's much easier to read and use. I only use the nft command when checking for the occasional chain/table that iptables didn't show me.
Laser@feddit.org · 2 pts · 22d
No mention of bpfilter unfortunately, would have been helpful to get a rough overview