From dc10688edbfabe516a708e6dc2341fb5cfc2d3ad Mon Sep 17 00:00:00 2001 From: Richard Zetterberg Date: Sat, 25 Mar 2017 16:34:02 +0100 Subject: nftables: adds information regarding nftables and Docker (#24326) --- nixos/modules/services/networking/nftables.nix | 11 +++++++++++ 1 file changed, 11 insertions(+) (limited to 'nixos') diff --git a/nixos/modules/services/networking/nftables.nix b/nixos/modules/services/networking/nftables.nix index 029c3df89932..56b942054140 100644 --- a/nixos/modules/services/networking/nftables.nix +++ b/nixos/modules/services/networking/nftables.nix @@ -17,6 +17,17 @@ in This conflicts with the standard networking firewall, so make sure to disable it before using nftables. + + Note that if you have Docker enabled you will not be able to use + nftables without intervention. Docker uses iptables internally to + setup NAT for containers. This module disables the ip_tables kernel + module, however Docker automatically loads the module. Please see [1] + for more information. + + There are other programs that use iptables internally too, such as + libvirt. + + [1]: https://github.com/NixOS/nixpkgs/issues/24318#issuecomment-289216273 ''; }; networking.nftables.ruleset = mkOption { -- cgit 1.4.1