b12f/nixpkgs
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

nixos/networkmanager: default firewallBackend to nftables, remove firewallBackend

Browse source 
Co-authored-by: Florian Klink <flokli@flokli.de>

Co-authored-by: Lin Jian <me@linj.tech>
This commit is contained in:
Sandro Jäckel 2023-07-01 16:10:20 +02:00 committed by Maciej Krüger
parent ad0ca163e1
commit 9a85d77152
No known key found for this signature in database
GPG key ID: 0D948CE19CF49C5F
2 changed files with 3 additions and 11 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
nixos/modules/services/networking/networkmanager.nix
View file

@ -35,7 +35,6 @@ let
rc-manager =
if config.networking.resolvconf.enable then "resolvconf"
else "unmanaged";
firewall-backend = cfg.firewallBackend;
})
(mkSection "keyfile" {
unmanaged-devices =
@ -232,15 +231,6 @@ in
'';
};
firewallBackend = mkOption {
type = types.enum [ "iptables" "nftables" "none" ];
default = "iptables";
description = lib.mdDoc ''
Which firewall backend should be used for configuring masquerading with shared mode.
If set to none, NetworkManager doesn't manage the configuration at all.
'';
};
logLevel = mkOption {
type = types.enum [ "OFF" "ERR" "WARN" "INFO" "DEBUG" "TRACE" ];
default = "WARN";
@ -412,6 +402,9 @@ in
them via the DNS server in your network, or use environment.etc
to add a file into /etc/NetworkManager/dnsmasq.d reconfiguring hostsdir.
'')
(mkRemovedOptionModule [ "networking" "networkmanager" "firewallBackend" ] ''
This option was removed as NixOS is now using iptables-nftables-compat even when using iptables, therefore Networkmanager now uses the nftables backend unconditionally.
'')
];

1
nixos/modules/services/networking/nftables.nix
View file

@ -248,7 +248,6 @@ in
config = mkIf cfg.enable {
boot.blacklistedKernelModules = [ "ip_tables" ];
environment.systemPackages = [ pkgs.nftables ];
networking.networkmanager.firewallBackend = mkDefault "nftables";
# versionOlder for backportability, remove afterwards
networking.nftables.flushRuleset = mkDefault (versionOlder config.system.stateVersion "23.11" || (cfg.rulesetFile != null || cfg.ruleset != ""));
systemd.services.nftables = {