!tCyGickeVqkHsYjWnh:nixos.org

NixOS Networking

886 Members
Declaratively manage your switching, routing, wireless, tunneling and more.259 Servers

Load older messages


SenderMessageTime
12 Oct 2025
@midirhee12:tchncs.de@midirhee12:tchncs.de removed their profile picture.21:27:42
@midirhee12:tchncs.de@midirhee12:tchncs.de removed their display name midirhee12.21:28:17
@midirhee12:tchncs.de@midirhee12:tchncs.de left the room.21:28:28
13 Oct 2025
@kdk12:matrix.orgKDK12 joined the room.11:41:46
@kdk12:matrix.orgKDK12Hi everyone! I'm using fail2ban to secure my server — it works fine, but I'd like to block known bad IP addresses before they can access anything. Currently, I have a small systemd service and timer that download a FireHOL blacklist daily and insert all the IPs into an nftables set. Is there a more idiomatic or less DIY way to achieve this on NixOS?13:21:57
@k900:0upti.meK900Honestly the correct answer is "just don't"13:26:32
@k900:0upti.meK900Address based blocklists are terrible and an adversary that can break ed25519 can do much more damage than pwning your seedbox13:27:05
@k900:0upti.meK900fail2ban may have made sense when people were actually using password auth13:27:48
@k900:0upti.meK900But as long as you're using public key auth, it's basically a non-issue, except for maybe DoS potential, but an attacker trying to DoS you can DoS anything else you're running just as well13:28:22
@kdk12:matrix.orgKDK12Fair point, thanks for the insight!13:53:05
@ewan:gilchrist.scotEwan joined the room.15:28:40
14 Oct 2025
@chrissq:matrix.orgchris joined the room.08:56:02
15 Oct 2025
@denkn:denkn.atDenKn changed their display name from 𝔇𝔢𝔫𝔎𝔫 to DenKn.08:15:36
@kraem:ne.bul.aekraemhey! on the lookout for a poe switch, fanless or very quiet, ideally openwrt compatible but not a must. i'm eyeing zyxel gs1900-8hp, any other i should checkout?20:32:55
@adam:robins.wtfadamcstephensHP 1920-8G JG920A would be a similar option that has no fan and can run openwrt20:51:03
@adam:robins.wtfadamcstephensoh sorry, you said POE. most (or all?) of the HP 1920 line is supported on openwrt. https://svanheule.net/switches/hpe_1920_series20:51:57
16 Oct 2025
@nickorta12:matrix.orgNick changed their display name from norta to Nick.02:22:59
@kraem:ne.bul.aekraemthanks, i'll check them out!05:25:16
@sross:matrix.orgSean Ross joined the room.23:03:26
@sross:matrix.orgSean Ross

Does anyone know why when using systemd without setting any networks "I want to control these with my own .link and .network files" I end up with a 40-lan1.network and a 40-wan1.network. I can not find any definitions for these in my config files and they are sym links to /etc/static/systemd/network/.

Here is my networking config

  systemd = {
    network = {
      enable = true;
      wait-online.timeout = 2;
      networks."99-ethernet-default-dhcp".enable = lib.mkForce false;
      networks."99-wireless-client-dhcp".enable = lib.mkForce false;
    };
    services."systemd-networkd-wait-online".enable = lib.mkDefault false;
  };

I can't even figure out how it chose the names lan1 and wan1

23:12:31
17 Oct 2025
@elvishjerricco:matrix.orgElvishJerricco Sean Ross: those get made when you have networking.useNetworkd = true; and networking.interfaces.lan1 = .... and whatnot. The point of networking.useNetworkd isn't to just enable networkd or anything; it's to reimplement most of the networking.* options using networkd 01:21:26
@sross:matrix.orgSean Ross ElvishJerricco: Thank you I think in a config somewhere I do have networking.useNetworkd = true; but I don't believe there is anything set like networking.interfaces.<name> = {};. I'll take another look when I get a chance. 01:24:16
@elvishjerricco:matrix.orgElvishJerricco use nixos-rebuild repl to poke around and check out what the final values of things like builtins.attrNames config.networking.interfaces is 01:24:53
@sross:matrix.orgSean RossAh that is really helpful I was wondering how to poke around in there. Does this also work with flakes?01:26:01
@elvishjerricco:matrix.orgElvishJerriccoshould01:26:29
@sross:matrix.orgSean Ross

looks like I needed to do something like sudo nixos-rebuild --flake "git+file:///etc/nixos/#<system_name>" repl
and it appears it is in there somewhere.

nix-repl> builtins.attrNames config.networking.interfaces
[
  "lan1"
  "wan1"
]

01:30:40
@elvishjerricco:matrix.orgElvishJerricco Sean Ross: You can look for the definitions with options.networking.interfaces.definitionsWithLocations I think 01:42:10
@sross:matrix.orgSean RossThank you01:44:28
@kdk12:matrix.orgKDK12Hey! With NixOS’s OpenSSH service, is there a way to specify user-specific SSH configuration like this — especially the ForceCommand option? Match User <user> ForceCommand <command> AllowTcpForwarding no PasswordAuthentication no Or do I have to use services.openssh.extraConfig for that?08:54:11
@magic_rb:matrix.redalder.orgmagic_rbExtra config afaik09:23:18

Show newer messages


Back to Room ListRoom Version: 6