nixos/wireguard: set networking.firewall.allowedUDPPorts automatically
#60124
Conversation
spacekookie
force-pushed
the
wireguard-automatic-firewall
branch
2 times, most recently
from
cc75535
to
e72eeea
Compare
This changes the wireguard module to automatically add the provided `listenPort` for an interface to the list of allowed udp ports in the firewall. This means that users don't have to do this themselves when configuring a wireguard server.
|
We typically don't want to do this, with the notable exception of openssh. This is because it is easy for users to add this configuration setting, but difficult for users to remove it. I would personally prefer we not do this, even though I do understand that it makes common case configuration easier. |
spacekookie
force-pushed
the
wireguard-automatic-firewall
branch
from
e72eeea
to
50d62e2
Compare
|
When would you want to set a listen port, but not make it accessible? |
|
For example, I might want to make it accessible on some interfaces but not others. |
|
For example, I might want to make it accessible on some interfaces but not others.
Makes sense to me I guess.
|
Alright, yea that makes sense. I couldn't find any issues/ PRs where this rationale had been pointed out explicitly before. So I guess this is now documentation 😅 |
Motivation for this change
This changes the wireguard module to automatically add the provided
listenPortfor an interface to the list of allowed udp ports in thefirewall. This means that users don't have to do this themselves when
configuring a wireguard server.
It also adjusts the wireguard test to not rely on explicitly-set
firewall ports
Things done
sandboxinnix.confon non-NixOS)nix-shell -p nix-review --run "nix-review wip"./result/bin/)nix path-info -Sbefore and after)