heartles/egirls-nixos
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Compare commits

base: heartles:264d64526c949b40a18d671d73b0858c4470d207
Branches Tags
heartles:main
heartles:mail-server
...
compare: heartles:38d2798bc65ac9afb802972a1291c6c4aa0ae6cd
Branches Tags
heartles:main
heartles:mail-server

3 commits
264d64526c ... 38d2798bc6

Author SHA1 Message Date
jaina heartles
38d2798bc6 block all email ports 2025-03-09 23:23:10 -04:00
jaina heartles
c9e55d49f1 flush rules on firewall teardown 2025-03-09 23:15:44 -04:00
jaina heartles
c1d318ba67 fix ipv6 block 2025-03-09 23:15:14 -04:00
1 changed files with 21 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

25
postfix.nix
View file

@ -1,13 +1,28 @@
{ pkgs, config, ... }:
{
networking.firewall.extraCommands = let user = config.services.postfix.user;
# Prevent outgoing connections to email ports from users other than postfix
# unless the destination is localhost
networking.firewall.extraCommands = let
user = config.services.postfix.user;
makeRules = port:
let p = builtins.toString port;
in ''
iptables -A OUTPUT -m owner ! --uid-owner ${user} -m tcp -p tcp --dport 25 -j REJECT --reject-with icmp-admin-prohibited
ip6tables -A OUTPUT -m owner ! --uid-owner ${user} -m tcp -p tcp --dport 25 -j REJECT --reject-with icmp6-adm-prohibited
iptables -A OUTPUT -m owner ! --uid-owner ${user} -m tcp -p tcp --dport ${p} -j REJECT --reject-with icmp-admin-prohibited
ip6tables -A OUTPUT -m owner ! --uid-owner ${user} -m tcp -p tcp --dport ${p} -j REJECT --reject-with icmp6-adm-prohibited
iptables -I OUTPUT -m tcp -p tcp --dport 25 -d 127.0.0.1 -j ACCEPT
ip6tables -I OUTPUT -m tcp -p tcp --dport 25 -d 127.0.0.1 -j ACCEPT
iptables -I OUTPUT -m tcp -p tcp --dport ${p} -d 127.0.0.1 -j ACCEPT
ip6tables -I OUTPUT -m tcp -p tcp --dport ${p} -d ::1 -j ACCEPT
'';
in builtins.concatStringsSep "\n"
(builtins.map makeRules [ 25 587 465 2525 ]);
# The following is necessary to prevent the above rules from being added at every nixos-rebuild switch.
# See link for more info
# https://github.com/NixOS/nixpkgs/issues/201614
# Flush the firewall rules
networking.firewall.extraStopCommands = ''
iptables -F
ip6tables -F
'';
services.postfix = {