From a1dd69d7615feb8d3f6ddc63351849f279344395 Mon Sep 17 00:00:00 2001 From: Maciej Krüger Date: Mon, 27 Mar 2023 20:09:46 +0200 Subject: networking/nftables: enable flushRuleset by default if rulset{,File} used --- nixos/modules/services/networking/nftables.nix | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/nixos/modules/services/networking/nftables.nix b/nixos/modules/services/networking/nftables.nix index 2107448131e..cf32876c2c5 100644 --- a/nixos/modules/services/networking/nftables.nix +++ b/nixos/modules/services/networking/nftables.nix @@ -229,7 +229,8 @@ in boot.blacklistedKernelModules = [ "ip_tables" ]; environment.systemPackages = [ pkgs.nftables ]; networking.networkmanager.firewallBackend = mkDefault "nftables"; - networking.nftables.flushRuleset = mkDefault (versionOlder config.system.stateVersion "23.11"); + # versionOlder for backportability, remove afterwards + networking.nftables.flushRuleset = mkDefault (versionOlder config.system.stateVersion "23.11" || (cfg.rulesetFile != null || cfg.ruleset != "")); systemd.services.nftables = { description = "nftables firewall"; before = [ "network-pre.target" ]; -- cgit 1.4.1