Unverified Commit 9a85d771 authored by Sandro Jäckel's avatar Sandro Jäckel Committed by Maciej Krüger
Browse files

nixos/networkmanager: default firewallBackend to nftables, remove firewallBackend 



Co-authored-by: default avatarFlorian Klink <flokli@flokli.de>

Co-authored-by: default avatarLin Jian <me@linj.tech>
parent ad0ca163

nixos/modules/services/networking/networkmanager.nix

+3 −10
Original line number Diff line number Diff line
@@ -35,7 +35,6 @@ let 
      rc-manager =

        if config.networking.resolvconf.enable then "resolvconf"

        else "unmanaged";

      firewall-backend = cfg.firewallBackend;

    })

    (mkSection "keyfile" {

      unmanaged-devices =
@@ -232,15 +231,6 @@ in 
        '';

      };



      firewallBackend = mkOption {

        type = types.enum [ "iptables" "nftables" "none" ];

        default = "iptables";

        description = lib.mdDoc ''

          Which firewall backend should be used for configuring masquerading with shared mode.

          If set to none, NetworkManager doesn't manage the configuration at all.

        '';

      };



      logLevel = mkOption {

        type = types.enum [ "OFF" "ERR" "WARN" "INFO" "DEBUG" "TRACE" ];

        default = "WARN";
@@ -412,6 +402,9 @@ in 
      them via the DNS server in your network, or use environment.etc

      to add a file into /etc/NetworkManager/dnsmasq.d reconfiguring hostsdir.

    '')

    (mkRemovedOptionModule [ "networking" "networkmanager" "firewallBackend" ] ''

      This option was removed as NixOS is now using iptables-nftables-compat even when using iptables, therefore Networkmanager now uses the nftables backend unconditionally.

    '')

  ];

nixos/modules/services/networking/nftables.nix

+0 −1
Original line number Diff line number Diff line
@@ -248,7 +248,6 @@ in 
  config = mkIf cfg.enable {

    boot.blacklistedKernelModules = [ "ip_tables" ];

    environment.systemPackages = [ pkgs.nftables ];

    networking.networkmanager.firewallBackend = mkDefault "nftables";

    # versionOlder for backportability, remove afterwards

    networking.nftables.flushRuleset = mkDefault (versionOlder config.system.stateVersion "23.11" || (cfg.rulesetFile != null || cfg.ruleset != ""));

    systemd.services.nftables = {