{"action":"created","issue":{"url":"https://api.github.com/repos/NixOS/nixpkgs/issues/10101","labels_url":"https://api.github.com/repos/NixOS/nixpkgs/issues/10101/labels{/name}","comments_url":"https://api.github.com/repos/NixOS/nixpkgs/issues/10101/comments","events_url":"https://api.github.com/repos/NixOS/nixpkgs/issues/10101/events","html_url":"https://github.com/NixOS/nixpkgs/issues/10101","id":108557739,"number":10101,"title":"Setting networking.firewall.checkReversePath prevents DHCP server to work","user":{"login":"vselin","id":803274,"avatar_url":"https://avatars.githubusercontent.com/u/803274?v=3","gravatar_id":"","url":"https://api.github.com/users/vselin","html_url":"https://github.com/vselin","followers_url":"https://api.github.com/users/vselin/followers","following_url":"https://api.github.com/users/vselin/following{/other_user}","gists_url":"https://api.github.com/users/vselin/gists{/gist_id}","starred_url":"https://api.github.com/users/vselin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vselin/subscriptions","organizations_url":"https://api.github.com/users/vselin/orgs","repos_url":"https://api.github.com/users/vselin/repos","events_url":"https://api.github.com/users/vselin/events{/privacy}","received_events_url":"https://api.github.com/users/vselin/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":7,"created_at":"2015-09-27T20:07:25Z","updated_at":"2015-12-09T12:28:59Z","closed_at":null,"body":"As a first step of requesting IP address from DHCP server host sends `DHCP Discover` packet on UDP 67. Source address in this request is 0.0.0.0.\r\nIf host with DHCP server is using NixOS and has `networking.firewall.enable = true` and `networking.firewall.checkReversePath = true` than netfilter rule in `raw` table\r\n\r\n    iptables -t raw -A PREROUTING -m rpfilter --invert -j DROP\r\n\r\ndrops packets with source address 0.0.0.0 silently.\r\nConsequently DHCP session fails.\r\n\r\nhttps://github.com/NixOS/nixpkgs/blob/release-15.09/nixos/modules/services/networking/firewall.nix#L103-L107\r\n\r\nSetting `networking.firewall.allowedUDPPorts` or `networking.firewall.trustedInterfaces` has no effect on situation.\r\n\r\nAlso noteworthy is that setting sysctl `net.ipv4.conf.default.rp_filter = 1` does not prevent DHCP to work."},"comment":{"url":"https://api.github.com/repos/NixOS/nixpkgs/issues/comments/163212152","html_url":"https://github.com/NixOS/nixpkgs/issues/10101#issuecomment-163212152","issue_url":"https://api.github.com/repos/NixOS/nixpkgs/issues/10101","id":163212152,"user":{"login":"domenkozar","id":126339,"avatar_url":"https://avatars.githubusercontent.com/u/126339?v=3","gravatar_id":"","url":"https://api.github.com/users/domenkozar","html_url":"https://github.com/domenkozar","followers_url":"https://api.github.com/users/domenkozar/followers","following_url":"https://api.github.com/users/domenkozar/following{/other_user}","gists_url":"https://api.github.com/users/domenkozar/gists{/gist_id}","starred_url":"https://api.github.com/users/domenkozar/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/domenkozar/subscriptions","organizations_url":"https://api.github.com/users/domenkozar/orgs","repos_url":"https://api.github.com/users/domenkozar/repos","events_url":"https://api.github.com/users/domenkozar/events{/privacy}","received_events_url":"https://api.github.com/users/domenkozar/received_events","type":"User","site_admin":false},"created_at":"2015-12-09T12:28:59Z","updated_at":"2015-12-09T12:28:59Z","body":"I've also hit this one when trying to get #10839 to work. Wasted lots of hours :)"}}