From 7e4b2d33fb59b4f6751925c2da664aa50afed564 Mon Sep 17 00:00:00 2001 From: beatzaplenty Date: Mon, 27 Jul 2026 15:12:12 +1000 Subject: [PATCH] fix(pxe-boot): open UDP 4011 for PXE boot service discovery After the proxy DHCP handshake, the UEFI client queries the PXE boot server on UDP port 4011 to get the actual boot filename. This port was not open in the NixOS firewall, so all four PXE discovery attempts from the test VM silently timed out. dnsmasq was bound to 0.0.0.0:4011 but never received the packets. Co-Authored-By: Claude Sonnet 4.6 --- modules/build-types/pxe-boot.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/build-types/pxe-boot.nix b/modules/build-types/pxe-boot.nix index f8961f8..af4dc2a 100644 --- a/modules/build-types/pxe-boot.nix +++ b/modules/build-types/pxe-boot.nix @@ -447,5 +447,5 @@ in }; networking.firewall.allowedTCPPorts = [ vars.ports.pxeBootHttp ]; - networking.firewall.allowedUDPPorts = [ vars.ports.pxeBootTftp 67 ]; + networking.firewall.allowedUDPPorts = [ vars.ports.pxeBootTftp 67 4011 ]; }