From fa9cdc83ab2a284aeaeebbeef89ec0d7eda17943 Mon Sep 17 00:00:00 2001
From: "Janik H." <janik@aq0.de>
Date: Sat, 18 Nov 2023 16:00:33 +0100
Subject: [PATCH] nixos/firewall: install nixos-firewall-tool for iptables by
 default

---
 nixos/doc/manual/release-notes/rl-2311.section.md       | 2 ++
 nixos/modules/services/networking/firewall-iptables.nix | 1 +
 2 files changed, 3 insertions(+)

diff --git a/nixos/doc/manual/release-notes/rl-2311.section.md b/nixos/doc/manual/release-notes/rl-2311.section.md
index d12695e20dea..2bbbdd58ad90 100644
--- a/nixos/doc/manual/release-notes/rl-2311.section.md
+++ b/nixos/doc/manual/release-notes/rl-2311.section.md
@@ -425,6 +425,8 @@
 
 - `zfs` was updated from 2.1.x to 2.2.0, [enabling newer kernel support and adding new features](https://github.com/openzfs/zfs/releases/tag/zfs-2.2.0).
 
+- The iptables firewall module now installs the `nixos-firewall-tool` which allows the user to easily temporarily open ports through the firewall.
+
 - Elixir now defaults to version
   [v1.15](https://elixir-lang.org/blog/2023/06/19/elixir-v1-15-0-released/).
 
diff --git a/nixos/modules/services/networking/firewall-iptables.nix b/nixos/modules/services/networking/firewall-iptables.nix
index 63e952194d67..e90086838720 100644
--- a/nixos/modules/services/networking/firewall-iptables.nix
+++ b/nixos/modules/services/networking/firewall-iptables.nix
@@ -301,6 +301,7 @@ in
       }
     ];
 
+    environment.systemPackages = [ pkgs.nixos-firewall-tool ];
     networking.firewall.checkReversePath = mkIf (!kernelHasRPFilter) (mkDefault false);
 
     systemd.services.firewall = {