From 3160f3b9d7df55983105b809835dbd4edf9a9ef5 Mon Sep 17 00:00:00 2001
From: Sizhe Zhao <prc.zhao@outlook.com>
Date: Sat, 20 Sep 2025 14:31:50 +0800
Subject: [PATCH] nixos/netbird: use firewalld zone

---
 nixos/modules/services/networking/netbird.nix | 36 +++++++++++++------
 1 file changed, 26 insertions(+), 10 deletions(-)

diff --git a/nixos/modules/services/networking/netbird.nix b/nixos/modules/services/networking/netbird.nix
index ba2c1be37c52..c19cf7d88edb 100644
--- a/nixos/modules/services/networking/netbird.nix
+++ b/nixos/modules/services/networking/netbird.nix
@@ -507,19 +507,35 @@ in
         ) "loose";
 
         # Ports opened on a specific
-        interfaces = listToAttrs (
-          toClientList (client: {
-            name = client.interface;
-            value.allowedUDPPorts = optionals client.openInternalFirewall [
-              # note: those should be opened up by NetBird itself, but it needs additional
-              #  NixOS -specific debugging and tweaking before it works
-              5353 # <0.59.0 DNS forwarder port, kept for compatibility with those clients
-              22054 # >=0.59.0 DNS forwarder port
-            ];
-          })
+        interfaces = lib.mkIf (config.networking.firewall.backend != "firewalld") (
+          listToAttrs (
+            toClientList (client: {
+              name = client.interface;
+              value.allowedUDPPorts = optionals client.openInternalFirewall [
+                # note: those should be opened up by NetBird itself, but it needs additional
+                #  NixOS -specific debugging and tweaking before it works
+                5353 # <0.59.0 DNS forwarder port, kept for compatibility with those clients
+                22054 # >=0.59.0 DNS forwarder port
+              ];
+            })
+          )
         );
       };
 
+      services.firewalld.zones.netbird = {
+        interfaces = lib.pipe cfg.clients [
+          (lib.filterAttrs (_: client: client.openFirewall))
+          lib.attrValues
+          (map (client: client.interface))
+        ];
+        ports = [
+          {
+            protocol = "udp";
+            port = 5353;
+          }
+        ];
+      };
+
       systemd.network.networks = mkIf config.networking.useNetworkd (
         toClientAttrs (
           client: