A practical guide to the four major Linux firewall technologies - iptables, nftables, firewalld, and ufw. Covers real-world cloud server hardening with concrete examples, from locking down SSH to b...
The beauty is that this, or your own custom modules, become a declarative and reproducible abstraction layer which (if properly written) lets you focus on the what rather than the how.
… You could also write a bunch of scripts, which is what I used to do before I joined the cult.
Nftables rulesets are reproducible and let you focus on what rather than how. I’ve tried nix some time ago, conceptually cool distro, but it requires a lot of time, time that can be used configuring emacs 😝.
For me it’s clearly not obvious what exactly ‘enabling firewall’ entails, what policy is applied, what rules, etc., etc.
There are sensible defaults but it ultimately depends on what the module is doing and how you configure it.
https://github.com/NixOS/nixpkgs/blob/8c91a71d13451abc40eb9dae8910f972f979852f/nixos/modules/services/networking/firewall.nix
The beauty is that this, or your own custom modules, become a declarative and reproducible abstraction layer which (if properly written) lets you focus on the what rather than the how.
… You could also write a bunch of scripts, which is what I used to do before I joined the cult.
Nftables rulesets are reproducible and let you focus on what rather than how. I’ve tried nix some time ago, conceptually cool distro, but it requires a lot of time, time that can be used configuring emacs 😝.