heartles/egirls-nixos
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

block all email ports

Browse source
This commit is contained in:
jaina heartles 2025-03-09 23:23:10 -04:00
parent c9e55d49f1
commit 38d2798bc6
1 changed files with 14 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

21
postfix.nix
View file

@ -1,14 +1,21 @@
{ pkgs, config, ... }:
{
networking.firewall.extraCommands = let user = config.services.postfix.user;
in ''
iptables -A OUTPUT -m owner ! --uid-owner ${user} -m tcp -p tcp --dport 25 -j REJECT --reject-with icmp-admin-prohibited
ip6tables -A OUTPUT -m owner ! --uid-owner ${user} -m tcp -p tcp --dport 25 -j REJECT --reject-with icmp6-adm-prohibited
# Prevent outgoing connections to email ports from users other than postfix
# unless the destination is localhost
networking.firewall.extraCommands = let
user = config.services.postfix.user;
makeRules = port:
let p = builtins.toString port;
in ''
iptables -A OUTPUT -m owner ! --uid-owner ${user} -m tcp -p tcp --dport ${p} -j REJECT --reject-with icmp-admin-prohibited
ip6tables -A OUTPUT -m owner ! --uid-owner ${user} -m tcp -p tcp --dport ${p} -j REJECT --reject-with icmp6-adm-prohibited
iptables -I OUTPUT -m tcp -p tcp --dport 25 -d 127.0.0.1 -j ACCEPT
ip6tables -I OUTPUT -m tcp -p tcp --dport 25 -d ::1 -j ACCEPT
'';
iptables -I OUTPUT -m tcp -p tcp --dport ${p} -d 127.0.0.1 -j ACCEPT
ip6tables -I OUTPUT -m tcp -p tcp --dport ${p} -d ::1 -j ACCEPT
'';
in builtins.concatStringsSep "\n"
(builtins.map makeRules [ 25 587 465 2525 ]);
# The following is necessary to prevent the above rules from being added at every nixos-rebuild switch.
# See link for more info
# https://github.com/NixOS/nixpkgs/issues/201614