net: switch from manual nftables to firewall module

hosts/imxyy-nix-x16/net.nix

@@ -12,45 +12,17 @@
   my.persist.nixosDirs = [ "/etc/NetworkManager/system-connections" ];
   networking = {
     networkmanager.enable = true;
-    firewall.enable = false;
-    nftables = {
+    firewall = {
       enable = true;
-      flushRuleset = true;
-      ruleset = ''
-        table inet firewall {
-          set LANv4 {
-            type ipv4_addr
-            flags interval
-
-            elements = { 10.0.0.0/8, 100.64.0.0/10, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16 }
-          }
-          set LANv6 {
-            type ipv6_addr
-            flags interval
-
-            elements = { fd00::/8, fe80::/10 }
-          }
-
-          chain output {
-            type filter hook output priority 100; policy accept;
-          }
-
-          chain input {
-            type filter hook input priority 0; policy drop;
-            iif lo accept
-            ct state invalid drop
-            ct state established,related accept
-
-            ip saddr @LANv4 accept
-            ip6 saddr @LANv6 accept
-          }
-
-          chain forward {
-            type filter hook forward priority 0; policy drop;
-          }
-        }
+      checkReversePath = false;
+      allowPing = false;
+      extraInputRules = ''
+        ip saddr { 10.0.0.0/8, 100.64.0.0/10, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16 } accept
+        ip6 saddr { fd00::/8, fe80::/10 } accept
       '';
+      filterForward = true;
     };
+    nftables.enable = true;
   };
 
   sops.secrets.dae-imxyy-nix-x16 = {
@@ -61,6 +33,7 @@
   services.dae = {
     enable = true;
     configFile = config.sops.secrets.dae-imxyy-nix-x16.path;
+    openFirewall.enable = false;
   };
   systemd.services.dae.after = [ "sops-nix.service" ];
   sops.secrets.mihomo = {