OOKNET                             [ /  search the index  ]  
──────────────────────────────────────────────────────────────────────────────────────
[ KB ]    [ GIT ]    [ PROJECTS ]    [ ABOUT ]                                      EN
══════════════════════════════════════════════════════════════════════════════════════
OOKNET   [ /  search  ]  
────────────────────────────────────────────────
[ KB ] [ GIT ] [ PROJECTS ] [ ABOUT ]
════════════════════════════════════════════════
 
HASH      22e35f8ef226
DATE      2026-07-11
SUBJECT   firewall: switch to nftables backend
FILES     1 CHANGED
HASH      22e35f8ef226
DATE      2026-07-11
SUBJECT   firewall: switch to nftables backend
FILES     1 CHANGED
 

diff --git a/modules/nixos/base/security/firewall.nix b/modules/nixos/base/securit
y/firewall.nix
index 1fe45c9..63605fa 100644
--- a/modules/nixos/base/security/firewall.nix
+++ b/modules/nixos/base/security/firewall.nix
@@ -1,14 +1,20 @@
 {
-  networking.firewall = {
-    enable = true;
+  networking = {
+    # nftables backend: cleaner source-scoped rules (extraInputRules) and
+    # unifies with the nftables fail2ban action already in use
+    nftables.enable = true;
 
-    allowedTCPPorts = [
-      22 # SSH
-      80
-      443
-    ];
+    firewall = {
+      enable = true;
 
-    # dont respond to icmpv4 pings.
-    allowPing = false;
+      allowedTCPPorts = [
+        22 # SSH
+        80
+        443
+      ];
+
+      # dont respond to icmpv4 pings.
+      allowPing = false;
+    };
   };
 }


diff --git a/modules/nixos/base/security/fir
ewall.nix b/modules/nixos/base/security/fire
wall.nix
index 1fe45c9..63605fa 100644
--- a/modules/nixos/base/security/firewall.n
ix
+++ b/modules/nixos/base/security/firewall.n
ix
@@ -1,14 +1,20 @@
 {
-  networking.firewall = {
-    enable = true;
+  networking = {
+    # nftables backend: cleaner source-scop
ed rules (extraInputRules) and
+    # unifies with the nftables fail2ban ac
tion already in use
+    nftables.enable = true;
 
-    allowedTCPPorts = [
-      22 # SSH
-      80
-      443
-    ];
+    firewall = {
+      enable = true;
 
-    # dont respond to icmpv4 pings.
-    allowPing = false;
+      allowedTCPPorts = [
+        22 # SSH
+        80
+        443
+      ];
+
+      # dont respond to icmpv4 pings.
+      allowPing = false;
+    };
   };
 }

 
[ BACK TO LOG ]
──────────────────────────────────────────────────────────────────────────────────────
OOKNET
────────────────────────────────────────────────
OOKNET