kernel-config: Begin adding configs for firewall
Ffixes
@@ -83,6 +83,52 @@ in
BLK_DEV_BSG = yes;
DEVPTS_MULTIPLE_INSTANCES = whenOlder "4.7" yes;
})
+ # Needed for firewall
+ (helpers: with helpers; let
+ inherit (lib) mkMerge;
+ # TODO drop when we fix modular kernels
+ module = yes;
+ in {
+ # Needed for nftables
+ # Networking Options
+ NETFILTER = yes;
+ NETFILTER_ADVANCED = yes;
+ # Core Netfilter Configuration
+ NF_CONNTRACK = yes;
+ NF_CONNTRACK_ZONES = yes;
+ NF_CONNTRACK_EVENTS = yes;
+ NF_CONNTRACK_TIMEOUT = yes;
+ NF_CONNTRACK_TIMESTAMP = yes;
+ NF_CT_NETLINK = yes;
+ NETFILTER_NETLINK_LOG = yes;
+ NETFILTER_NETLINK_QUEUE = yes;
+ NETFILTER_NETLINK_GLUE_CT = whenAtLeast "4.4" yes;
+ NF_TABLES = whenAtLeast "3.13" yes;
+ NF_TABLES_INET = mkMerge [ (whenBetween "3.14" "4.17" module) (whenAtLeast "4.17" yes) ];
+ NF_TABLES_NETDEV = mkMerge [ (whenBetween "4.2" "4.17" module) (whenAtLeast "4.17" yes) ];
+ NFT_REJECT = whenAtLeast "3.14" yes;
+ NFT_REJECT_IPV4 = whenAtLeast "3.14" yes;
+ NFT_REJECT_IPV6 = whenAtLeast "3.14" yes;
+ NFT_REJECT_NETDEV = whenAtLeast "5.11" module;
+ # IP: Netfilter Configuration
+ NF_TABLES_IPV4 = mkMerge [ (whenBetween "3.13" "4.17" module) (whenAtLeast "4.17" yes) ];
+ NF_TABLES_ARP = mkMerge [ (whenBetween "3.13" "4.17" module) (whenAtLeast "4.17" yes) ];
+ # IPv6: Netfilter Configuration
+ NF_TABLES_IPV6 = mkMerge [ (whenBetween "3.13" "4.17" module) (whenAtLeast "4.17" yes) ];
+ # Bridge Netfilter Configuration
+ NF_TABLES_BRIDGE = mkMerge [ (whenBetween "4.19" "5.3" yes) (whenAtLeast "5.3" module) ];
+
+ # Further dependencies in older kernels
+ IP_NF_IPTABLES = yes;
+ IP6_NF_IPTABLES = yes;
+ NETFILTER_XTABLES = yes;
+ IP_NF_RAW = yes;
+ IP6_NF_RAW = yes;
+ NETFILTER_XT_TARGET_CT = yes; # required for NF_CONNTRACK_ZONES
+
+ # Reportedly needed for the firewall
+ NETFILTER_XT_MATCH_PKTTYPE = yes;
+ })
];
nixpkgs.overlays = [(final: super: {
