networking.firewall = { 
    allowPing = true;
    allowedTCPPorts = [ 80 443 22000 ]; # 22000 syncthing traffic
    allowedUDPPorts = [ 21027 ]; # 21027 syncthing discovery
    allowedUDPPortRanges = [ 
      { from = 60000; to = 60100; } # mosh, mobile shell
    ];  
  };