depot/nixos/doc/manual/configuration/firewall.section.md
Luke Granger-Brown 57725ef3ec Squashed 'third_party/nixpkgs/' content from commit 76612b17c0ce
git-subtree-dir: third_party/nixpkgs
git-subtree-split: 76612b17c0ce71689921ca12d9ffdc9c23ce40b2
2024-11-10 23:59:47 +00:00

901 B

Firewall

NixOS has a simple stateful firewall that blocks incoming connections and other unexpected packets. The firewall applies to both IPv4 and IPv6 traffic. It is enabled by default. It can be disabled as follows:

{
  networking.firewall.enable = false;
}

If the firewall is enabled, you can open specific TCP ports to the outside world:

{
  networking.firewall.allowedTCPPorts = [ 80 443 ];
}

Note that TCP port 22 (ssh) is opened automatically if the SSH daemon is enabled (services.openssh.enable = true). UDP ports can be opened through .

To open ranges of TCP ports:

{
  networking.firewall.allowedTCPPortRanges = [
    { from = 4000; to = 4007; }
    { from = 8000; to = 8010; }
  ];
}

Similarly, UDP port ranges can be opened through .