# What's the best way to setup a firewall in Guix?

**URL:** <https://forum.systemcrafters.net/t/whats-the-best-way-to-setup-a-firewall-in-guix/1474>\
**Category:** Guix\
**Created:** [March 10, 2025, 12:23pm UTC](https://forum.systemcrafters.net/t/whats-the-best-way-to-setup-a-firewall-in-guix/1474 "2025-03-10T12:23:02Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Themightyox](https://avatars.discourse-cdn.com/v4/letter/t/51bf81/32.png) [@Themightyox](https://forum.systemcrafters.net/u/Themightyox)\
**Post date:** [March 10, 2025, 12:23pm UTC](https://forum.systemcrafters.net/t/whats-the-best-way-to-setup-a-firewall-in-guix/1474/1 "2025-03-10T12:23:02Z")

</div>

I’m interested in declaring a nftable in my config. I can see there is a default ruleset in the documentation `%default-nftables-ruleset`, however, it keeps the ssh port open which isn’t something I need on my desktop setup. What would be the best way to go about modifying this ruleset or declaring a custom one?

I’m relatively new to Guix and Scheme so any pointers would be much appreciated

---

<div class="post-metadata">

**Author:** ![heq](https://avatars.discourse-cdn.com/v4/letter/h/41988e/32.png) [@heq](https://forum.systemcrafters.net/u/heq)\
**Post date:** [March 10, 2025, 1:14pm UTC](https://forum.systemcrafters.net/t/whats-the-best-way-to-setup-a-firewall-in-guix/1474/2 "2025-03-10T13:14:38Z")

</div>

This is what I’ve got.

```scheme
            (service nftables-service-type
                     (nftables-configuration
                      (ruleset (plain-file "nftables.conf"
                                           "\
# A simple and safe firewall (based on %default-nftables-ruleset)
define pub_iface = \"enp11s0\"
define wg_iface = \"wg0\"
define wg_port = 51820
define ssh_port = 22
define guix_publish_port = 8080

table inet filter {
  chain input {
    type filter hook input priority 0; policy drop;

    # early drop of invalid connections
    ct state invalid drop

    # allow established/related connections
    ct state { established, related } accept

    # allow from loopback
    iif lo accept
    # drop connections to lo not coming from lo
    iif != lo ip daddr 127.0.0.1/8 drop
    iif != lo ip6 daddr ::1/128 drop

    # allow icmp
    ip protocol icmp accept
    ip6 nexthdr icmpv6 accept

    # allow ssh
    tcp dport $ssh_port accept

    # allow guix publish
    tcp dport $guix_publish_port accept

    # allow wireguard port
    udp dport $wg_port accept

    # reject everything else
    reject with icmpx type port-unreachable
  }
  chain output {
    type filter hook output priority 0; policy accept;
  }
}
"))))

```

---

<div class="post-metadata">

**Author:** ![Themightyox](https://avatars.discourse-cdn.com/v4/letter/t/51bf81/32.png) [@Themightyox](https://forum.systemcrafters.net/u/Themightyox)\
**Post date:** [March 10, 2025, 2:02pm UTC](https://forum.systemcrafters.net/t/whats-the-best-way-to-setup-a-firewall-in-guix/1474/3 "2025-03-10T14:02:50Z")

</div>

Awesome, thanks a lot. I’ll use that for my config but with

```auto
tcp dport $ssh_port accept

```

commented out and a few tweaks 🙂

---

<div class="post-metadata">

**Author:** ![daviwil](https://yyz1.discourse-cdn.com/flex029/user_avatar/forum.systemcrafters.net/daviwil/32/1_2.png) [@daviwil](https://forum.systemcrafters.net/u/daviwil)\
**Post date:** [March 12, 2025, 12:17pm UTC](https://forum.systemcrafters.net/t/whats-the-best-way-to-setup-a-firewall-in-guix/1474/4 "2025-03-12T12:17:11Z")

</div>

Nice, thanks for the example!

What are people’s thoughts on nftables vs iptables? Looks like the syntax for nftables may be a little more expressive, are there other reasons why it’s a better choice?

---

<div class="post-metadata">

**Author:** ![daviwil](https://yyz1.discourse-cdn.com/flex029/user_avatar/forum.systemcrafters.net/daviwil/32/1_2.png) [@daviwil](https://forum.systemcrafters.net/u/daviwil)\
**Post date:** [March 12, 2025, 12:17pm UTC](https://forum.systemcrafters.net/t/whats-the-best-way-to-setup-a-firewall-in-guix/1474/5 "2025-03-12T12:17:36Z")

</div>

By the way, welcome to the community @heq and @Themightyox!

---

<div class="post-metadata">

**Author:** ![Themightyox](https://avatars.discourse-cdn.com/v4/letter/t/51bf81/32.png) [@Themightyox](https://forum.systemcrafters.net/u/Themightyox)\
**Post date:** [March 18, 2025, 1:12pm UTC](https://forum.systemcrafters.net/t/whats-the-best-way-to-setup-a-firewall-in-guix/1474/6 "2025-03-18T13:12:06Z")

</div>

Thank you. Seems like you’ve made a lovely community here 😃 !

As to iptables and nftables. I believe they’re largely identical beyond that. Though certain applications like Docker still don’t play well with nftables—they are in the process of upgrading, however.

---

<div class="post-metadata">

**Author:** ![tinhead](https://yyz1.discourse-cdn.com/flex029/user_avatar/forum.systemcrafters.net/tinhead/32/602_2.png) [@tinhead](https://forum.systemcrafters.net/u/tinhead)\
**Post date:** [March 25, 2025, 5:06pm UTC](https://forum.systemcrafters.net/t/whats-the-best-way-to-setup-a-firewall-in-guix/1474/7 "2025-03-25T17:06:49Z")

</div>

Hi,

I know this is solved but if you would like you could have a look here for a more declarative approach: [th-guix-channel/th/services/firehol.scm at main · TinHead/th-guix-channel · GitHub](https://github.com/TinHead/th-guix-channel/blob/main/th/services/firehol.scm)

Cheers,  
TH