Unverified Commit a1dd69d7 authored by Maciej Krüger's avatar Maciej Krüger
Browse files

networking/nftables: enable flushRuleset by default if rulset{,File} used

parent 55213b54

nixos/modules/services/networking/nftables.nix

+2 −1
Original line number Diff line number Diff line
@@ -229,7 +229,8 @@ in 
    boot.blacklistedKernelModules = [ "ip_tables" ];

    environment.systemPackages = [ pkgs.nftables ];

    networking.networkmanager.firewallBackend = mkDefault "nftables";

    networking.nftables.flushRuleset = mkDefault (versionOlder config.system.stateVersion "23.11");

    # versionOlder for backportability, remove afterwards

    networking.nftables.flushRuleset = mkDefault (versionOlder config.system.stateVersion "23.11" || (cfg.rulesetFile != null || cfg.ruleset != ""));

    systemd.services.nftables = {

      description = "nftables firewall";

      before = [ "network-pre.target" ];