2 files changed, 3 insertions, 9 deletions

diff --git a/hosts/surtr/dns/default.nix b/hosts/surtr/dns/default.nix
index ce909b72..746b3ee8 100644
--- a/hosts/surtr/dns/default.nix
+++ b/hosts/surtr/dns/default.nix
@@ -7,15 +7,6 @@
       };
 
     systemd.services.knot.unitConfig.RequiresMountsFor = [ "/var/lib/knot" ];
-
-    networking.firewall = {
-      allowedTCPPorts = [
-        53 # DNS
-      ];
-      allowedUDPPorts = [
-        53 # DNS
-      ];
-    };
     
     services.knot = {
       enable = true;
diff --git a/hosts/surtr/ruleset.nft b/hosts/surtr/ruleset.nft
index 6b47751f..f8cadc94 100644
--- a/hosts/surtr/ruleset.nft
+++ b/hosts/surtr/ruleset.nft
@@ -79,6 +79,9 @@ table inet filter {
     meta protocol ip6 udp dport 51821 counter accept
     udp dport 60000-61000 counter accept
 
+    tcp dport 53 counter accept
+    udp dport 53 counter accept
+
 
     limit name lim_reject log prefix "drop input: " counter drop
     log prefix "reject input: " counter