From 760f43a69e47fbbca3a9db56dcf7ac0c1d307ca3 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Wed, 8 Apr 2026 01:34:05 +0200 Subject: [PATCH] nixos/firewall: disable refused connections logging On any server on the internet this causes fast rotation of the kernel ringbuffer, which makes more important message disappear from dmesg much too quickly. --- nixos/doc/manual/release-notes/rl-2605.section.md | 6 ++++++ nixos/modules/services/networking/firewall.nix | 2 +- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/nixos/doc/manual/release-notes/rl-2605.section.md b/nixos/doc/manual/release-notes/rl-2605.section.md index 3090f9ee8891..ce14eba26764 100644 --- a/nixos/doc/manual/release-notes/rl-2605.section.md +++ b/nixos/doc/manual/release-notes/rl-2605.section.md @@ -343,6 +343,12 @@ See . - `services.slurm` now supports slurmrestd usage through the `services.slurm.rest` NixOS options. +- The `networking.firewall.logRefusedConnections` option now defaults to + `false`. Logging of refused or dropped incoming connections can generate a + very high volume of kernel log messages on internet-facing systems, causing + the kernel ring buffer (dmesg) to rotate quickly and potentially discard more + relevant diagnostic information. + - The `services.calibre-web` systemd service has been hardened with additional sandboxing restrictions. - `services.kanidm` options for server, client and unix were moved under dedicated namespaces. diff --git a/nixos/modules/services/networking/firewall.nix b/nixos/modules/services/networking/firewall.nix index 95308c2a9cfc..2e3d1250ef2c 100644 --- a/nixos/modules/services/networking/firewall.nix +++ b/nixos/modules/services/networking/firewall.nix @@ -118,7 +118,7 @@ in logRefusedConnections = lib.mkOption { type = lib.types.bool; - default = true; + default = false; description = '' Whether to log rejected or dropped incoming connections. Note: The logs are found in the kernel logs, i.e. dmesg