coolneng
/
panacea
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Route all traffic through Wireguard

This commit is contained in:
coolneng 2022-09-10 09:11:26 +02:00
parent b21acadd8e
commit fa739cfb87
Signed by: coolneng
GPG Key ID: 9893DA236405AF57
1 changed files with 35 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

38
modules/networking.nix
View File

@ -1,6 +1,8 @@
{ config, lib, pkgs, ... }: { config, lib, pkgs, ... }:
{ let wireguard_port = "51902";
in {
# Set hostname, hostid and enable WiFi # Set hostname, hostid and enable WiFi
networking = { networking = {
hostName = "panacea"; hostName = "panacea";
@ -52,7 +54,11 @@
Kind = "wireguard"; Kind = "wireguard";
Name = "wg0"; Name = "wg0";
}; };
wireguardConfig.PrivateKeyFile = config.age.secrets.wireguard.path; wireguardConfig = {
ListenPort = wireguard_port;
PrivateKeyFile = config.age.secrets.wireguard.path;
FirewallMark = 34952;
};
wireguardPeers = [{ wireguardPeers = [{
wireguardPeerConfig = { wireguardPeerConfig = {
PublicKey = "GN8lqPBZYOulh6xD4GhkoEWI65HMMCpSxJSH5871YnU="; PublicKey = "GN8lqPBZYOulh6xD4GhkoEWI65HMMCpSxJSH5871YnU=";
@ -63,11 +69,28 @@
}; };
systemd.network.networks."wg0" = { systemd.network.networks."wg0" = {
matchConfig.Name = "wg0"; matchConfig.Name = "wg0";
linkConfig.ActivationPolicy = "manual";
networkConfig = { networkConfig = {
Address = "10.8.0.2/32"; Address = "10.8.0.2/32";
DNS = "10.8.0.1"; DNS = "10.8.0.1";
DNSDefaultRoute = true;
Domains = "~.";
}; };
routes = [{ routeConfig.Destination = "10.8.0.1"; }]; routingPolicyRules = [{
routingPolicyRuleConfig = {
FirewallMark = 34952;
InvertRule = true;
Table = 1000;
Priority = 10;
};
}];
routes = [{
routeConfig = {
Gateway = "10.8.0.1";
GatewayOnLink = true;
Table = 1000;
};
}];
}; };
# Firewall configuration # Firewall configuration
@ -78,5 +101,14 @@
allowedUDPPorts = [ allowedUDPPorts = [
54982 # Calibre Wireless 54982 # Calibre Wireless
]; ];
# Allow wireguard traffic
extraCommands = ''
ip46tables -t raw -I nixos-fw-rpfilter -p udp -m udp --sport ${wireguard_port} -j RETURN
ip46tables -t raw -I nixos-fw-rpfilter -p udp -m udp --dport ${wireguard_port} -j RETURN
'';
extraStopCommands = ''
ip46tables -t raw -D nixos-fw-rpfilter -p udp -m udp --sport ${wireguard_port} -j RETURN || true
ip46tables -t raw -D nixos-fw-rpfilter -p udp -m udp --dport ${wireguard_port} -j RETURN || true
'';
}; };
} }