From dd9cc36cd012f499ba350a79ff8947b43c1e1008 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Janne=20He=C3=9F?= <janne@hess.ooo>
Date: Mon, 24 Nov 2025 16:49:15 +0100
Subject: [PATCH] nixos/resolved: Fix nix-daemon-firewall with resolved

---
 nixos/modules/system/boot/resolved.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/nixos/modules/system/boot/resolved.nix b/nixos/modules/system/boot/resolved.nix
index bf72d2f2747f..f11f76ef8f64 100644
--- a/nixos/modules/system/boot/resolved.nix
+++ b/nixos/modules/system/boot/resolved.nix
@@ -213,6 +213,10 @@ in
 
       networking.resolvconf.package = pkgs.systemd;
 
+      nix.firewall.extraNftablesRules = [
+        "ip daddr { 127.0.0.53, 127.0.0.54 } udp dport 53 accept comment \"systemd-resolved listening IPs\""
+      ];
+
     })
 
     (mkIf config.boot.initrd.services.resolved.enable {