net: switch from manual nftables to firewall module

hosts/imxyy-nix/net.nix

@@ -43,49 +43,22 @@
       "192.168.3.2"
     ];
 
-    firewall.enable = false;
-    nftables = {
+    firewall = {
       enable = true;
-      flushRuleset = true;
-      ruleset = ''
-        table inet firewall {
-          set LANv4 {
-            type ipv4_addr
-            flags interval
-
-            elements = { 10.0.0.0/8, 100.64.0.0/10, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16 }
-          }
-          set LANv6 {
-            type ipv6_addr
-            flags interval
-
-            elements = { fd00::/8, fe80::/10 }
-          }
-
-          chain output {
-            type filter hook output priority 100; policy accept;
-          }
-
-          chain input {
-            type filter hook input priority 0; policy drop;
-            iif lo accept
-            iifname waydroid0 accept
-            ct state invalid drop
-            ct state established,related accept
-
-            ip saddr @LANv4 accept
-            ip6 saddr @LANv6 accept
-          }
-
-          chain forward {
-            type filter hook forward priority 0; policy drop;
-
-            iifname waydroid0 accept
-            oifname waydroid0 accept
-          }
-        }
+      checkReversePath = false;
+      allowPing = false;
+      trustedInterfaces = [ "waydroid0" ];
+      extraInputRules = ''
+        ip saddr { 10.0.0.0/8, 100.64.0.0/10, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16 } accept
+        ip6 saddr { fd00::/8, fe80::/10 } accept
+      '';
+      filterForward = true;
+      extraForwardRules = ''
+        iifname waydroid0 accept
+        oifname waydroid0 accept
       '';
     };
+    nftables.enable = true;
   };
 
   sops.secrets.dae-imxyy-nix = {
@@ -96,6 +69,7 @@
   services.dae = {
     enable = true;
     configFile = config.sops.secrets.dae-imxyy-nix.path;
+    openFirewall.enable = false;
   };
   systemd.services.dae.after = [ "sops-nix.service" ];
   sops.secrets.mihomo = {