1 files changed, 10 insertions, 16 deletions
diff --git a/hosts/tacitus/network.nix b/hosts/tacitus/network.nix
index 513d89c..9b3beef 100644
--- a/hosts/tacitus/network.nix
+++ b/hosts/tacitus/network.nix
@@ -48,27 +48,21 @@ in
       ];
     };
   };
-  networking = {
-    useNetworkd = true;
-    nftables.enable = true;
-    useDHCP = true;
-    firewall = {
-      # check  enable = true;
-      checkReversePath = false;
+
+  wilkuu.firewall = {
+    enable = true;
+    defaultLayer = "internal";
+    layers.internal = {
       allowedTCPPorts = baseTCP;
       allowedUDPPorts = baseUDP;
       allowedUDPPortRanges = baseUDPRanges;
       allowedTCPPortRanges = baseTCPRanges;
-      # TODO: Figure out how to do FW that allows only on the internal ip range
-      #interfaces = {
-      #  "wg-home" = {
-      #   allowedTCPPorts = secureTCP;
-      #   allowedUDPPorts = secureUDP;
-      #   allowedUDPPortRanges = secureUDPRanges;
-      #   allowedTCPPortRanges = secureTCPRanges;
-      # };
-      #};
     };
   };
+  networking = {
+    useNetworkd = true;
+    nftables.enable = true;
+    useDHCP = true;
+  };
 
 }