nix/system/Firewall.nix

{ lib, ... }:
{
  networking.firewall = {
    enable = true;

    # NOTE: Configure manually with `extraCommands`.
    allowedTCPPortRanges = lib.mkForce [ ];
    allowedTCPPorts = lib.mkForce [ ];
    allowedUDPPortRanges = lib.mkForce [ ];
    allowedUDPPorts = lib.mkForce [ ];

    allowPing = true;
    rejectPackets = false; # Drop.

    logRefusedConnections = false;
    logRefusedPackets = false;
    logRefusedUnicastsOnly = true;
    logReversePathDrops = false;
  };
}