NixOS in it’s current form does have it’s limitations but it’s ever improving. I personally have never had issues doing what I needed to firewall wise, but I’ve not done much of anything complex. Mostly just opening ports and a little port redirecting.
Removing the need for 32 bit libs in the future is big.