Inherited NixOS firewall behaviour is currently both implicit and restrictive; all incoming TCP ports are blocked by default, inherited native services (such as the sshd used for deployment) implicitly modify this service to open the ports they listen on (22). Similar behaviour is absent from our own functionalities, and to the best of my knowledge defnix exposes no facility for firewall modification beside scripted execution of iptables directives.
When deploying functionalities to EC2, this is complicated further; the native firewall is disabled, but replaced with hard-coded security groups (currently exposing {22,500,4500}.)
One solution that occurs is implicit revision on AF_INET6 socket configuration (reflected both in iptables and EC2 security groups), though this occurs as over-zealous. Perhaps better is to define our own firewall service in place of the native one (with selective replication between netfilter and security groups, to permit local IP communication.)
Inherited NixOS firewall behaviour is currently both implicit and restrictive; all incoming TCP ports are blocked by default, inherited native services (such as the
sshdused for deployment) implicitly modify this service to open the ports they listen on (22). Similar behaviour is absent from our own functionalities, and to the best of my knowledgedefnixexposes no facility for firewall modification beside scripted execution ofiptablesdirectives.When deploying functionalities to EC2, this is complicated further; the native firewall is disabled, but replaced with hard-coded security groups (currently exposing {22,500,4500}.)
One solution that occurs is implicit revision on AF_INET6 socket configuration (reflected both in
iptablesand EC2 security groups), though this occurs as over-zealous. Perhaps better is to define our own firewall service in place of the native one (with selective replication between)netfilterand security groups, to permit local IP communication.