nftables: restarting nftables.service destroys rules created by other services

[nagisa]

Describe the bug

Restarting the nftables.service will clear tables that are set up by other services such as systemd-networkd or e.g. tailscaled.

Steps To Reproduce

Steps to reproduce the behavior:

1. Add a systemd-networkd network with a networkConfig.IPMasquerade - "both" option;
2. Observe networkd creating a table ip io.systemd.nat, with sudo nft list tables
3. sudo systemctl restart nftables
4. sudo nft list tables and observe that table ip io.systemd.nat is now gone.

Expected behavior

Restarting the nftables service should not remove the tables from other services, or it should ensure the services know to set up their tables again.

The latter seems pretty hard to achieve however. For networkd networkctl reconfigure $interface will reset these rules (sudo systemctl reload systemd-networkd.service on the other hand will not) so NixOS will know to go through all the interfaces affected interfaces.

For tools like tailscaled the only way I know right now involves at least a full reconfiguration (so a service restart most likely.)

Notify maintainers

No meta.maintainers in nftables firewall module

Metadata

Please run nix-shell -p nix-info --run "nix-info -m" and paste the result.

• system: "x86_64-linux"
• host os: Linux 6.1.68, NixOS, 24.05 (Uakari), 24.05.20240131.b8b232a
• multi-user?: yes
• sandbox: yes
• version: nix-env (Nix) 2.18.1
• nixpkgs: /run/current-system/nixpkgs

---

Add a :+1: reaction to issues you find important.

[duament]

There's an option for it. Please set networking.nftables.flushRuleset to false. This option is set to false by default since stateVersion "23.11".