networking.firewall = {
   allowPing = true;
   allowedTCPPorts = [ 22222 ];
   checkReversePath = "strict";
   enable = true;
   extraCommands = "ip46tables -P INPUT DROP";
   extraPackages = [ pkgs.ipset ];
   logRefusedConnections = false;
};