fix upnp firewall rules

modules/services/mkMesh.nix

@@ -52,17 +52,26 @@ in {
   };
   config = rec {
     networking.firewall = {
-      allowedUDPPorts =
-        [
+      allowedUDPPorts = [
         currentHost.wg.port_v4
         currentHost.wg.port_v6
-        ]
+      ];
       # UPnP broadcast responses
-        ++ (
+      # credits: https://github.com/NixOS/nixpkgs/issues/161328
+      extraPackages =
         if cfg.enable_upnp_portforward
-          then [1900]
-          else []
-        );
+        then [pkgs.ipset]
+        else [];
+      extraCommands =
+        if cfg.enable_upnp_portforward
+        then ''
+          if ! ipset --quiet list upnp; then
+            ipset create upnp hash:ip,port timeout 3
+          fi
+          iptables -A OUTPUT -d 239.255.255.250/32 -p udp -m udp --dport 1900 -j SET --add-set upnp src,src --exist
+          iptables -A nixos-fw -p udp -m set --match-set upnp dst,dst -j nixos-fw-accept
+        ''
+        else "";
     };
 
     networking.wireguard.interfaces.wg0 = {