use networking.firewall instead of nftables.ruleset

parsons/nftables.nix

@@ -1,7 +1,7 @@
 { config, lib, pkgs, ... }:
 
 {
-  networking.firewall.enable = false;
+  networking.firewall.enable = true;
   networking.nat.enable = false;
   boot = {
     kernelModules = [ "nf_nat_ftp" ];
@@ -11,58 +11,10 @@
     };
   };
 
-  networking.nftables = {
+  networking.nftables.enable = true;
-    enable = true;
+  networking.nftables.tables.nat = {
-
+    family = "ip";
-    ruleset = ''
+    content = ''
-      table inet filter {
-        chain input {
-          type filter hook input priority filter
-          policy drop
-
-          icmpv6 type {
-            echo-request,
-            echo-reply,
-            mld-listener-query,
-            mld-listener-report,
-            mld-listener-done,
-            nd-router-advert,
-            nd-neighbor-solicit,
-            nd-neighbor-advert,
-            packet-too-big
-          } accept
-
-          icmp type echo-request accept
-
-          ct state invalid drop
-          ct state established,related accept
-
-          iifname { lo } accept
-
-          tcp dport { 25, 80, 443, 465, 587, 993, 4190, 62954, 64738 } accept
-
-          udp dport { 60000-61000, 64738 } accept
-
-          # DHCPv6
-          ip6 daddr fe80::/64 udp dport 546 accept
-
-          counter
-        }
-        chain output {
-          type filter hook output priority filter
-          policy accept
-
-          counter
-        }
-        chain forward {
-          type filter hook forward priority filter
-          policy accept
-
-          counter
-        }
-      }
-
-      table ip nat {
       chain prerouting {
         type nat hook prerouting priority -100
         iifname enp35s0 tcp dport { 22 } dnat ${config.containers.forgejo.localAddress}:22
@@ -72,7 +24,6 @@
         iifname lxcbr0 oifname enp35s0 masquerade
         iifname ve-* oifname enp35s0 masquerade
       }
-      }
     '';
   };
 }