# NixOS default network protections

**URL:** https://discourse.nixos.org/t/nixos-default-network-protections/6583
**Category:** Help
**Created:** [April 6, 2020, 11:31am UTC](https://discourse.nixos.org/t/nixos-default-network-protections/6583 "2020-04-06T11:31:48Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![pasqui23](https://discourse.nixos.org/letter_avatar_proxy/v4/letter/p/ee7513/32.png) [@pasqui23](https://discourse.nixos.org/u/pasqui23)
#### Post date: [April 6, 2020, 11:31am UTC](https://discourse.nixos.org/t/nixos-default-network-protections/6583/1 "2020-04-06T11:31:48Z")

</div>

I know that Nixos by default blocks listening all ports and it’s an unwritten policy that no module should open ports.  
What other security network protections Nixos put on by default?

---

<div class="post-metadata">

### Author: ![NobbZ](https://discourse.nixos.org/user_avatar/discourse.nixos.org/nobbz/32/7022_2.png) [@NobbZ](https://discourse.nixos.org/u/NobbZ)
#### Post date: [April 6, 2020, 11:10pm UTC](https://discourse.nixos.org/t/nixos-default-network-protections/6583/2 "2020-04-06T23:10:25Z")

</div>

But don’t the SSH and httpd modules do exactly that? Once enabled, they open the port?

---

<div class="post-metadata">

### Author: ![aanderse](https://discourse.nixos.org/user_avatar/discourse.nixos.org/aanderse/32/1420_2.png) [@aanderse](https://discourse.nixos.org/u/aanderse)
#### Post date: [April 6, 2020, 11:16pm UTC](https://discourse.nixos.org/t/nixos-default-network-protections/6583/3 "2020-04-06T23:16:23Z")

</div>

Only ssh opens ports by default.

---

<div class="post-metadata">

### Author: ![NobbZ](https://discourse.nixos.org/user_avatar/discourse.nixos.org/nobbz/32/7022_2.png) [@NobbZ](https://discourse.nixos.org/u/NobbZ)
#### Post date: [April 6, 2020, 11:17pm UTC](https://discourse.nixos.org/t/nixos-default-network-protections/6583/4 "2020-04-06T23:17:50Z")

</div>

Ah, okay, then I misunderstood something. I don’t have anything enabled except for SSH so far.

---

<div class="post-metadata">

### Author: ![aanderse](https://discourse.nixos.org/user_avatar/discourse.nixos.org/aanderse/32/1420_2.png) [@aanderse](https://discourse.nixos.org/u/aanderse)
#### Post date: [April 6, 2020, 11:28pm UTC](https://discourse.nixos.org/t/nixos-default-network-protections/6583/5 "2020-04-06T23:28:58Z")

</div>

Many modules have an `openFirewall` option. Maybe you were thinking about that?

---

<div class="post-metadata">

### Author: ![pasqui23](https://discourse.nixos.org/letter_avatar_proxy/v4/letter/p/ee7513/32.png) [@pasqui23](https://discourse.nixos.org/u/pasqui23)
#### Post date: [April 7, 2020, 9:20am UTC](https://discourse.nixos.org/t/nixos-default-network-protections/6583/6 "2020-04-07T09:20:42Z")

</div>

Mostly I wanted to know if there were any other gotchas in the default network configuration.