Unverified Commit cd3af259 authored by Maciej Krüger's avatar Maciej Krüger
Browse files

networking/nftables: enable flushing ruleset for older versions



Co-authored-by: default avatarNaïm Favier <n@monade.li>
parent 311d2fa9
Loading
Loading
Loading
Loading
+4 −0
Original line number Diff line number Diff line
@@ -83,6 +83,8 @@ in
      '';
    };

    networking.nftables.flushRuleset = mkEnableOption (lib.mdDoc "Flush the entire ruleset on each reload.");

    networking.nftables.ruleset = mkOption {
      type = types.lines;
      default = "";
@@ -209,6 +211,7 @@ in
    boot.blacklistedKernelModules = [ "ip_tables" ];
    environment.systemPackages = [ pkgs.nftables ];
    networking.networkmanager.firewallBackend = mkDefault "nftables";
    networking.nftables.flushRuleset = mkDefault (versionOlder config.system.stateVersion "23.11");
    systemd.services.nftables = {
      description = "nftables firewall";
      before = [ "network-pre.target" ];
@@ -222,6 +225,7 @@ in
          executable = true;
          text = ''
            #! ${pkgs.nftables}/bin/nft -f
            ${optionalString cfg.flushRuleset "flush ruleset"}
            ${concatStringsSep "\n" (mapAttrsToList (_: table: ''
              table ${table.family} ${table.name}
              delete table ${table.family} ${table.name}