diff options
Diffstat (limited to 'nixos/doc/manual/from_md/configuration/firewall.section.xml')
| -rw-r--r-- | nixos/doc/manual/from_md/configuration/firewall.section.xml | 39 |
1 files changed, 39 insertions, 0 deletions
diff --git a/nixos/doc/manual/from_md/configuration/firewall.section.xml b/nixos/doc/manual/from_md/configuration/firewall.section.xml new file mode 100644 index 00000000000..24c19bb1c66 --- /dev/null +++ b/nixos/doc/manual/from_md/configuration/firewall.section.xml @@ -0,0 +1,39 @@ +<section xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" xml:id="sec-firewall"> + <title>Firewall</title> + <para> + NixOS has a simple stateful firewall that blocks incoming + connections and other unexpected packets. The firewall applies to + both IPv4 and IPv6 traffic. It is enabled by default. It can be + disabled as follows: + </para> + <programlisting language="bash"> +networking.firewall.enable = false; +</programlisting> + <para> + If the firewall is enabled, you can open specific TCP ports to the + outside world: + </para> + <programlisting language="bash"> +networking.firewall.allowedTCPPorts = [ 80 443 ]; +</programlisting> + <para> + Note that TCP port 22 (ssh) is opened automatically if the SSH + daemon is enabled + (<literal>services.openssh.enable = true</literal>). UDP ports can + be opened through + <xref linkend="opt-networking.firewall.allowedUDPPorts" />. + </para> + <para> + To open ranges of TCP ports: + </para> + <programlisting language="bash"> +networking.firewall.allowedTCPPortRanges = [ + { from = 4000; to = 4007; } + { from = 8000; to = 8010; } +]; +</programlisting> + <para> + Similarly, UDP port ranges can be opened through + <xref linkend="opt-networking.firewall.allowedUDPPortRanges" />. + </para> +</section> |