drop nixos firewall, use nftables directly

1 files changed, 0 insertions, 26 deletions

diff --git a/wireguard.nix b/wireguard.nix
index d36d8f3..df48ebf 100644
--- a/wireguard.nix
+++ b/wireguard.nix
@@ -46,32 +46,6 @@ in
     format = "binary";
   };
 
-  networking = {
-    firewall.allowedUDPPorts = [ wgPort ];
-
-    nftables = {
-      enable = true;
-      tables.wg-mdns = {
-        enable = true;
-        family = "inet";
-        content = ''
-          # chain prerouting {
-          #   type filter hook prerouting priority mangle;
-          #   iifname "wg0" meta mark set ${toString firewallMark}
-          # }
-
-          chain input {
-            type filter hook input priority filter;
-
-            # Allow mDNS only over wireguard
-            # udp dport 5353 meta mark ${toString firewallMark} accept
-            udp dport 5353 accept
-          }
-        '';
-      };
-    };
-  };
-
   services.resolved.settings.Resolve.MulticastDNS = false;
   systemd.network = {
     enable = true;