diff options
| author | Eelco Dolstra <eelco.dolstra@logicblox.com> | 2014-04-11 16:29:45 +0200 |
|---|---|---|
| committer | Eelco Dolstra <eelco.dolstra@logicblox.com> | 2014-04-11 17:16:44 +0200 |
| commit | 017408e048ae2419baf0adba424b51d85b063a30 (patch) | |
| tree | 74cd0619882ac91fb287d5cb3d366ccef2e894d8 /nixos/modules/services/networking/firewall.nix | |
| parent | b9281e6a2dd3252052e69e15609b8e871c97c711 (diff) | |
| download | nixlib-017408e048ae2419baf0adba424b51d85b063a30.tar nixlib-017408e048ae2419baf0adba424b51d85b063a30.tar.gz nixlib-017408e048ae2419baf0adba424b51d85b063a30.tar.bz2 nixlib-017408e048ae2419baf0adba424b51d85b063a30.tar.lz nixlib-017408e048ae2419baf0adba424b51d85b063a30.tar.xz nixlib-017408e048ae2419baf0adba424b51d85b063a30.tar.zst nixlib-017408e048ae2419baf0adba424b51d85b063a30.zip | |
Use iptables' ‘-w’ flag
This prevents errors like "Another app is currently holding the xtables lock" if the firewall and NAT services are starting in parallel. (Longer term, we should probably move to a single service for managing the iptables rules.)
Diffstat (limited to 'nixos/modules/services/networking/firewall.nix')
| -rw-r--r-- | nixos/modules/services/networking/firewall.nix | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/nixos/modules/services/networking/firewall.nix b/nixos/modules/services/networking/firewall.nix index 62d92ba50e18..a1ca5dcdcb19 100644 --- a/nixos/modules/services/networking/firewall.nix +++ b/nixos/modules/services/networking/firewall.nix @@ -32,9 +32,9 @@ let '' # Helper command to manipulate both the IPv4 and IPv6 tables. ip46tables() { - iptables "$@" + iptables -w "$@" ${optionalString config.networking.enableIPv6 '' - ip6tables "$@" + ip6tables -w "$@" ''} } ''; @@ -386,7 +386,7 @@ in # Optionally respond to ICMPv4 pings. ${optionalString cfg.allowPing '' - iptables -A nixos-fw -p icmp --icmp-type echo-request ${optionalString (cfg.pingLimit != null) + iptables -w -A nixos-fw -p icmp --icmp-type echo-request ${optionalString (cfg.pingLimit != null) "-m limit ${cfg.pingLimit} " }-j nixos-fw-accept ''} |