Add separate rules for v4 and v6

hosts/nachtigall/apps/forgejo.nix

@@ -43,9 +43,20 @@
 
   # Expose SSH port only for forgejo SSH
   networking.firewall.interfaces.enp35s0.allowedTCPPorts = [ 2223 ];
-  networking.firewall.extraCommands = ''
-    iptables -t nat -i enp35s0 -I PREROUTING -p tcp --dport 22 -j REDIRECT --to-ports 2223
-  '';
+  networking.nat.forwardPorts = [
+    {
+      proto = "tcp";
+      sourcePort = 22;
+      destination = "127.0.0.1:2223";
+      loopbackIPs = [ "138.201.80.102" ];
+    }
+    {
+      proto = "tcp";
+      sourcePort = 22;
+      destination = "[::1]:2223";
+      loopbackIPs = [ "2a01:4f8:172:1c25::1" ];
+    }
+  ];
 
   services.forgejo = {
     enable = true;

hosts/nachtigall/networking.nix

@@ -25,4 +25,10 @@
   ];
   networking.defaultGateway = "138.201.80.65";
   networking.defaultGateway6 = { address = "fe80::1"; interface = "enp35s0"; };
+
+  networking.nat = {
+    enable = true;
+    enableIPv6 = true;
+    externalInterface = "enp35s0";
+  };
 }