use networking.firewall instead of nftables.ruleset

parsons/nftables.nix

@@ -1,7 +1,7 @@
 { config, lib, pkgs, ... }:
 
 {
-  networking.firewall.enable = false;
+  networking.firewall.enable = true;
   networking.nat.enable = false;
   boot = {
     kernelModules = [ "nf_nat_ftp" ];
@@ -11,67 +11,18 @@
     };
   };
 
-  networking.nftables = {
+  networking.nftables.enable = true;
-    enable = true;
+  networking.nftables.tables.nat = {
-
+    family = "ip";
-    ruleset = ''
+    content = ''
-      table inet filter {
+      chain prerouting {
-        chain input {
+        type nat hook prerouting priority -100
-          type filter hook input priority filter
+        iifname enp35s0 tcp dport { 22 } dnat ${config.containers.forgejo.localAddress}:22
-          policy drop
-
-          icmpv6 type {
-            echo-request,
-            echo-reply,
-            mld-listener-query,
-            mld-listener-report,
-            mld-listener-done,
-            nd-router-advert,
-            nd-neighbor-solicit,
-            nd-neighbor-advert,
-            packet-too-big
-          } accept
-
-          icmp type echo-request accept
-
-          ct state invalid drop
-          ct state established,related accept
-
-          iifname { lo } accept
-
-          tcp dport { 25, 80, 443, 465, 587, 993, 4190, 62954, 64738 } accept
-
-          udp dport { 60000-61000, 64738 } accept
-
-          # DHCPv6
-          ip6 daddr fe80::/64 udp dport 546 accept
-
-          counter
-        }
-        chain output {
-          type filter hook output priority filter
-          policy accept
-
-          counter
-        }
-        chain forward {
-          type filter hook forward priority filter
-          policy accept
-
-          counter
-        }
       }
-
+      chain postrouting {
-      table ip nat {
+        type nat hook postrouting priority 100
-        chain prerouting {
+        iifname lxcbr0 oifname enp35s0 masquerade
-          type nat hook prerouting priority -100
+        iifname ve-* oifname enp35s0 masquerade
-          iifname enp35s0 tcp dport { 22 } dnat ${config.containers.forgejo.localAddress}:22
-        }
-        chain postrouting {
-          type nat hook postrouting priority 100
-          iifname lxcbr0 oifname enp35s0 masquerade
-          iifname ve-* oifname enp35s0 masquerade
-        }
       }
     '';
   };