From 11ed9993db51a62d5364a423e1091884365d33fc Mon Sep 17 00:00:00 2001
From: Isabella Bastaja <isabella@sorre.xyz>
Date: Sat, 30 May 2026 13:58:41 +0200
Subject: drop nixos firewall, use nftables directly

---
 wireguard.nix | 26 --------------------------
 1 file changed, 26 deletions(-)

(limited to 'wireguard.nix')

diff --git a/wireguard.nix b/wireguard.nix
index d36d8f3..df48ebf 100644
--- a/wireguard.nix
+++ b/wireguard.nix
@@ -46,32 +46,6 @@ in
     format = "binary";
   };
 
-  networking = {
-    firewall.allowedUDPPorts = [ wgPort ];
-
-    nftables = {
-      enable = true;
-      tables.wg-mdns = {
-        enable = true;
-        family = "inet";
-        content = ''
-          # chain prerouting {
-          #   type filter hook prerouting priority mangle;
-          #   iifname "wg0" meta mark set ${toString firewallMark}
-          # }
-
-          chain input {
-            type filter hook input priority filter;
-
-            # Allow mDNS only over wireguard
-            # udp dport 5353 meta mark ${toString firewallMark} accept
-            udp dport 5353 accept
-          }
-        '';
-      };
-    };
-  };
-
   services.resolved.settings.Resolve.MulticastDNS = false;
   systemd.network = {
     enable = true;
-- 
cgit v1.3.1