Did you achieve this using the OpenSnitch Nix options over at search.nixos.org/options ?
I tend to put all the random grab bags rules needed for basic functionality in the opensnitch.nix module. If a package needed rules it gets a module and they go in there. Check the signal.nix module for a good example