Change:
On NixOS 21.05, when setting , I could see the result of this settings by running: Since NixOS 21.11 however, altought the masquerade works, I cannot see anything with iptables commands: As discussed on the Discourse topic , I suspect this is linked to the following change in NixOS 21.11 (PR ): Steps to reproduce the behavior: an interface with on a system running NixOS 21.11 the lack of information about the IP masquerade The IP masquerade should be visible like in NixOS 21.05:
This issue has been mentioned on NixOS Discourse. There might be relevant details there:
Actually, this is due to systemd since v248 preferring to use nftables if available, see Systemd does not use the iptables binaries and but a separate library that creates iptables rules directly without translation to nft by iptables-nft. So even without using the legacy iptables tools, these rules in nftables by networkd would not be visible. Other services that need to add firewall rules like libvirtd, docker or podman are likely getting proper nftables support soon and users still using iptables will run into the same issues. Since we are not the only distribution dealing with this, this should either be solved in systemd (can rules be generated that are compatible to and can be parsed by iptables-nft?) or in iptables-nft by displaying a warning that other nftables rules are active. The only related problem remaining in NixOS is that since our module is heavily based around iptables, our users assume NixOS is using iptables when in fact it is using nftables with iptables compatibility. cc
This particular issue is also giving me issues running docker on NixOS 21.11 in WSL2 on Windows 10. It requires iptables and the docker service fails to start due to docker trying to issue iptables a command and the nftables reply throws docker as an error. Same configuration using systemd v247 via 21.05 works fine
What you're seeing is directly caused by and has nothing to with this issue since the problem described here is that not all active rules are visible. Are we even supporting WSL officially? You might want to open a separate issue for this if you're interested in seeing support or getting this fixed. We would need to detect if nftables support is available and use the correct iptables package everywhere. Not sure if it's worth it, though.
this seems to also cause problems when upgrading systems from before the nftables bump. In my case, these were fixed after a reboot, but it's still a pretty annoying thing, for which we probably should at least make sure there's a release note entry. cc
Hmmh, I'm also a bit baffled about how to interpret defaulting to false. ~It seems and are mutually exclusive, but since we now configure nftables in other places, the firewall module is just broken?~
It seems only supports defining all rules exclusively, which doesn't play very nicely together with other things invoking iptables, or managing rules by themselves (like networkd , libvirt and other programs invoking iptables). Maybe that module needs a bit of a re-vamp - with merged we might want to configure most of what the module was doing, except managing the ruleset by default. However, that's a bit offtopic from the original issue.
you should see nftable tables when invoking , which is where systemd keeps its nft rules. iptables rules configured with the command are in . I think this is mostly a matter of updating the release notes, and raising awareness, that nftables is used, the command is only managing some tables in the nft system, and that there's more rules than what you can see with . I'll try to come up with a PR updating the release notes in that regard. It might not be possible to translate some nftable rules to a iptables syntax - I'm not sure if logging a warning breaks backwards compat with some tools relying on iptables output…
I improved the docs in , PTAL. Fixing the nftables module, and using less iptables in the firewall module should probably be left to another PR.
I opened to track the nftables NixOS module improvements.

Discussion:
</listitem> <listitem> <para> <del> <literal>iptables</literal> now uses <literal>nf_tables</literal> backend. </del> <ins> <literal>iptables</literal> is now using <literal>nf_tables</literal> under the hood, by using <literal>iptables-nft</literal>, similar to <link xlink:href="https://wiki.debian.org/nftables#Current_status">Debian</link> and <link xlink:href="https://fedoraproject.org/wiki/Changes/iptables-nft-default">Fedora</link>. This means, <literal>ip[6]tables</literal>, <literal>arptables</literal> and <literal>ebtables</literal> commands will actually show rules from some specific tables in the <literal>nf_tables</literal> kernel subsystem. </para> </listitem> <listitem> <para> systemd got an <literal>nftables</literal> backend, and configures (networkd) rules in their own <literal>io.systemd.*</literal> tables. Check <literal>nft list ruleset</literal> to see these rules, not <literal>iptables-save</literal> (which only shows <literal>iptables</literal>-created rules. </ins> </para> </listitem> <listitem>

- Nix has been updated to version 2.4, reference its [release notes](https://discourse.nixos.org/t/nix-2-4-released/15822) for more information on what has changed. The previous version of Nix, 2.3.16, remains available for the time being in the `nix_2_3` package. <del> - `iptables` now uses `nf_tables` backend. </del> <ins> - `iptables` is now using `nf_tables` under the hood, by using `iptables-nft`, similar to [Debian](https://wiki.debian.org/nftables#Current_status) and [Fedora](https://fedoraproject.org/wiki/Changes/iptables-nft-default). This means, `ip[6]tables`, `arptables` and `ebtables` commands  will actually show rules from some specific tables in the `nf_tables` kernel subsystem. - systemd got an `nftables` backend, and configures (networkd) rules in their own `io.systemd.*` tables. Check `nft list ruleset` to see these rules, not `iptables-save` (which only shows `iptables`-created rules. </ins> - PHP now defaults to PHP 8.0, updated from 7.4.