poz/niksos
poz/niksos
1
3
Fork 1
Code Issues Pull requests Projects Releases Packages Wiki Activity

wireguard shenanigans part 2

Browse source
This commit is contained in:
jacekpoz 2023-07-20 15:51:48 +02:00
parent 2ceff0d146
commit 975f113bec
4 changed files with 44 additions and 13 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

20
hosts/chmura/wireguard.nix
View file

@ -10,31 +10,27 @@
internalInterfaces = [ "wg0" ];
};
networking.firewall.allowedTCPPorts = [ 51820 ];
networking.firewall.allowedUDPPorts = [ 51820 ];
networking.firewall = {
allowedUDPPorts = [ 51820 ];
};
networking.wireguard.interfaces = {
wg0 = {
ips = [ "192.168.15.17/24" ];
ips = [ "192.168.15.1/24" ];
listenPort = 51820;
postSetup = ''
${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 192.168.15.0/24 -o eth0 -j MASQUERADE
${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 192.168.15.0/24 -o enp6s0 -j MASQUERADE
'';
postShutdown = ''
${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 192.168.15.0/24 -o eth0 -j MASQUERADE
${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 192.168.15.0/24 -o enp6s0 -j MASQUERADE
'';
privateKeyFile = "/home/chmura/.wg/private";
peers = [
{
# laptop with arch
publicKey = "yYCaxmZfyQQiOzlZuvNqbsY96j/UkqCh/+2guEqTuho=";
allowedIPs = [ "192.168.15.0/24" ];
}
{
# phone
publicKey = "aIz3n7fmtc85Td3bLa/78s90cxjpGw2LI098fpWcAhk=";
# main laptop
publicKey = "y+bdB0CdX6xm4vK2p2+5vQey9gEDphBf8V/DFt1oaC0=";
allowedIPs = [ "192.168.15.0/24" ];
}
];

5
hosts/niks/configuration.nix
View file

@ -126,7 +126,10 @@ in
};
hardware = {
opentabletdriver.enable = true;
opentabletdriver = {
enable = true;
daemon.enable = true;
};
bluetooth.enable = true;
};

1
hosts/niks/default.nix
View file

@ -4,5 +4,6 @@ _: {
./hardware-configuration.nix
./mullvad
./ssh
./wireguard
];
}

31
hosts/niks/wireguard/default.nix Normal file
View file

@ -0,0 +1,31 @@
{
config,
pkgs,
...
}: {
networking = {
firewall = {
allowedUDPPorts = [ 51820 ];
checkReversePath = "loose";
};
wireguard = {
dynamicEndpointRefreshSeconds = 5;
interfaces = {
ch0 = {
ips = [ "10.100.0.2/24" ];
listenPort = 51820;
privateKeyFile = "/home/jacek/.wg/chmura";
peers = [
{
publicKey = "cq4ZqnPM7wVGkoiquDbQLNuqEiPuHa/CLiGFow6buUI=";
allowedIPs = [ "0.0.0.0/0" ];
endpoint = "hcq082e0b05.sn.mynetname.net:51820";
persistentKeepalive = 25;
}
];
};
};
};
};
}