provider-firewalls.md

Provider firewalls

Every host’s packet filter is the NixOS firewall (modules/base.nix: on, stateful, only SSH open; roles open their own ports). A provider firewall in front of it (netcup’s firewall policy, a Hetzner Cloud Firewall) is a second layer that lives outside this repo. It must let through at least what the host opens, and, if it doesn’t track connections, the replies to what the host sends. This page is the list, and the reason for each entry, so the rules can be set by hand today and generated through the providers’ APIs later.

Convention: one catch-all rule allows all outbound traffic; every other rule is for inbound TCP or UDP. So the tables below are inbound only.

The NixOS config is the source of truth for inbound ports. Check this page against it after changing a role:

nix eval --json '.#nixosConfigurations."<fqdn>".config.networking.firewall' \
  --apply 'f: { inherit (f) allowedTCPPorts allowedUDPPorts extraCommands; }'

Stateful or not

• Hetzner Cloud Firewall: stateful. Replies to outbound traffic are allowed automatically, so the inbound rules below plus the outbound catch-all are all it needs. None is active today.
• netcup firewall policy: behaves as stateless for UDP (observed 2026-10-08). Replies to the box’s UDP queries arrive on a random high port and were dropped until rules allowed them by source port. TCP replies get through. So a netcup host also needs the UDP reply rules.

Per host

“Opened by” is the module that opens the port in the NixOS firewall. Keep the provider rule in step with it.

infra.mymood.at (netcup): moods, sovrn-metrics, sovrn-relay

netcup’s policy as set on 2026-10-08 matches this table. Its default policy also blocked outbound TCP 25, 465 and 587; that rule was deleted on 2026-10-06 (plan, “infra.mymood.at: network”). If netcup re-applies its default, Alertmanager’s mail (Resend, 587) stops.

mx99.eu.sovrn.at (Hetzner): sovrn-cell

No provider firewall today. If one is added, every sovrn cell needs:

ManageSieve (4190) and Stalwart’s HTTP (8080, loopback) stay closed. The relay addresses come from hosts.json; a generated rule should read them from there as well, so a moved relay updates both layers.

infra.rtw.run (Hetzner): forge

No provider firewall today.

UDP replies

Needed only behind a firewall that doesn’t track UDP (netcup). Each source port and what breaks without it. None of these fails loudly.

A future service that queries something over UDP adds its server’s port here. Allowing inbound UDP to the local ephemeral range (32768-60999, net.ipv4.ip_local_port_range) would cover everything at once, but it is broader than needed while the provider can match on source port.

Outbound (reference)

Covered by the catch-all. This list is for checking a provider’s own outbound blocks (netcup’s default policy blocked SMTP ports; Hetzner blocks some on new accounts) or for narrowing the catch-all one day:

Nothing needs outbound TCP 25: the cells send through SMTP2GO, and the relay delivers only to the cells on 2525. Hetzner blocks outbound 25 and 465 on new Cloud accounts until asked, so this layout keeps working there.

Checking

From the host, after changing a provider rule:

# UDP replies (DNS, IPv4 and IPv6): expect status NOERROR, not "timed out"
nix shell nixpkgs#dig -c dig +time=3 +tries=1 @198.41.0.4 . SOA
nix shell nixpkgs#dig -c dig +time=3 +tries=1 @2001:503:ba3e::2:30 . SOA
# NTP: NTPSynchronized=yes and a packet count above 0
timedatectl show -p NTPSynchronized; timedatectl timesync-status
# Stalwart's resolver (sovrn hosts): expect an answer within a second
host -p 5335 example.com 127.0.0.1

For pyzor, send a test message and compare the Stalwart log’s DMARC and queue.message-queued timestamps: about 0.2 s with a warm cache, 5 s more if pyzor’s replies are dropped. For inbound ports, test from outside (for example check-host.net for TCP 25 and 443).