{"action":"created","issue":{"url":"https://api.github.com/repos/NixOS/nixpkgs/issues/4155","labels_url":"https://api.github.com/repos/NixOS/nixpkgs/issues/4155/labels{/name}","comments_url":"https://api.github.com/repos/NixOS/nixpkgs/issues/4155/comments","events_url":"https://api.github.com/repos/NixOS/nixpkgs/issues/4155/events","html_url":"https://github.com/NixOS/nixpkgs/issues/4155","id":43182286,"number":4155,"title":"nixos/{firewall,nat}: Standardize around an iptables-restore / nftables solution","user":{"login":"wkennington","id":1773309,"avatar_url":"https://avatars.githubusercontent.com/u/1773309?v=3","gravatar_id":"","url":"https://api.github.com/users/wkennington","html_url":"https://github.com/wkennington","followers_url":"https://api.github.com/users/wkennington/followers","following_url":"https://api.github.com/users/wkennington/following{/other_user}","gists_url":"https://api.github.com/users/wkennington/gists{/gist_id}","starred_url":"https://api.github.com/users/wkennington/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wkennington/subscriptions","organizations_url":"https://api.github.com/users/wkennington/orgs","repos_url":"https://api.github.com/users/wkennington/repos","events_url":"https://api.github.com/users/wkennington/events{/privacy}","received_events_url":"https://api.github.com/users/wkennington/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/NixOS/nixpkgs/labels/enhancement","name":"enhancement","color":"84b6eb"},{"url":"https://api.github.com/repos/NixOS/nixpkgs/labels/feedback-requested","name":"feedback-requested","color":"f7c6c7"},{"url":"https://api.github.com/repos/NixOS/nixpkgs/labels/work-in-progress","name":"work-in-progress","color":"207de5"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":12,"created_at":"2014-09-18T21:44:47Z","updated_at":"2015-09-15T18:53:31Z","closed_at":null,"body":"Right now we use a command defined set of firewall rules. This allows for mutability of rules during normal operation and a simple, flexible interface for users to add new firewall rules using iptables commands.\r\n\r\nWhile this approach has worked in the past, it would be nice to standardize on a cleaner firewall interface using the iptables-restore or nftables utilities.\r\n\r\nPersonally I'd like to see nftables used for this, as it seems to be the future direction of the linux packet filtering stack."},"comment":{"url":"https://api.github.com/repos/NixOS/nixpkgs/issues/comments/140498686","html_url":"https://github.com/NixOS/nixpkgs/issues/4155#issuecomment-140498686","issue_url":"https://api.github.com/repos/NixOS/nixpkgs/issues/4155","id":140498686,"user":{"login":"wkennington","id":1773309,"avatar_url":"https://avatars.githubusercontent.com/u/1773309?v=3","gravatar_id":"","url":"https://api.github.com/users/wkennington","html_url":"https://github.com/wkennington","followers_url":"https://api.github.com/users/wkennington/followers","following_url":"https://api.github.com/users/wkennington/following{/other_user}","gists_url":"https://api.github.com/users/wkennington/gists{/gist_id}","starred_url":"https://api.github.com/users/wkennington/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wkennington/subscriptions","organizations_url":"https://api.github.com/users/wkennington/orgs","repos_url":"https://api.github.com/users/wkennington/repos","events_url":"https://api.github.com/users/wkennington/events{/privacy}","received_events_url":"https://api.github.com/users/wkennington/received_events","type":"User","site_admin":false},"created_at":"2015-09-15T18:53:31Z","updated_at":"2015-09-15T18:53:31Z","body":"That's utterly terrible given the only way to configure a marginally\ncomplex firewall with our current options is to use extraCommands. It would\nmake way more sense to drop all runtime supplied firewall rules before\nbreaking extraCommands, as users should not expect NixOS to preserve\nstateful configuration which it already manages.\n\nAgain, this is why a new interface needs to be made. There is no reason why\nwe can't create options which have the ability to define complex nftables\nor iptables-restore rules. This would then replace the current firewall\nwith something flexible that shouldn't need extraCommands.\n\nOn Tue, Sep 15, 2015, 11:42 Eelco Dolstra <notifications@github.com> wrote:\n\n> Sacrificing extraCommands sounds acceptable if we get an atomically\n> updated firewall in exchange.\n>\n> —\n> Reply to this email directly or view it on GitHub\n> <https://github.com/NixOS/nixpkgs/issues/4155#issuecomment-140494742>.\n>\n"}}