networking/nftables: enable flushing ruleset for older versions
Co-authored-by: Naïm Favier <n@monade.li>
This commit is contained in:
parent
311d2fa994
commit
cd3af25932
|
@ -83,6 +83,8 @@ in
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
|
|
||||||
|
networking.nftables.flushRuleset = mkEnableOption (lib.mdDoc "Flush the entire ruleset on each reload.");
|
||||||
|
|
||||||
networking.nftables.ruleset = mkOption {
|
networking.nftables.ruleset = mkOption {
|
||||||
type = types.lines;
|
type = types.lines;
|
||||||
default = "";
|
default = "";
|
||||||
|
@ -209,6 +211,7 @@ in
|
||||||
boot.blacklistedKernelModules = [ "ip_tables" ];
|
boot.blacklistedKernelModules = [ "ip_tables" ];
|
||||||
environment.systemPackages = [ pkgs.nftables ];
|
environment.systemPackages = [ pkgs.nftables ];
|
||||||
networking.networkmanager.firewallBackend = mkDefault "nftables";
|
networking.networkmanager.firewallBackend = mkDefault "nftables";
|
||||||
|
networking.nftables.flushRuleset = mkDefault (versionOlder config.system.stateVersion "23.11");
|
||||||
systemd.services.nftables = {
|
systemd.services.nftables = {
|
||||||
description = "nftables firewall";
|
description = "nftables firewall";
|
||||||
before = [ "network-pre.target" ];
|
before = [ "network-pre.target" ];
|
||||||
|
@ -222,6 +225,7 @@ in
|
||||||
executable = true;
|
executable = true;
|
||||||
text = ''
|
text = ''
|
||||||
#! ${pkgs.nftables}/bin/nft -f
|
#! ${pkgs.nftables}/bin/nft -f
|
||||||
|
${optionalString cfg.flushRuleset "flush ruleset"}
|
||||||
${concatStringsSep "\n" (mapAttrsToList (_: table: ''
|
${concatStringsSep "\n" (mapAttrsToList (_: table: ''
|
||||||
table ${table.family} ${table.name}
|
table ${table.family} ${table.name}
|
||||||
delete table ${table.family} ${table.name}
|
delete table ${table.family} ${table.name}
|
||||||
|
|
Loading…
Reference in a new issue