Currently the NixOS firewall will block all ports by default, except for port 22 if openssh is enabled. Why does this special behavior apply only to ssh? It would be very nice if we could create an option for the firewall that would allow services to automatically allow traffic to their specified ports.

This will smooth out a pretty big pain point, because while blocking all traffic by default is good security practice it can be really disorienting for users. NixOS declarative nature means we know which services are enabled and on which ports they should be listening. This means the firewall can automatically listen only on ports with configured services.

This would require all services that listen on ports to support this, but I think it would be a phenomenal idea that would make it way easier for people to get started with NixOS.