cilly/flakes
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

system/wireguard: declarative port forwarding

Browse source
This commit is contained in:
LavaDesu 2022-02-13 17:45:31 +07:00
parent 6cafe8fb74
commit 1ef0a5c034
Signed by: cilly
GPG key ID: 6500251E087653C9
1 changed files with 23 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

27
modules/system/wireguard.nix
View file

@ -5,6 +5,23 @@ let
serverInterface = "ens3"; serverInterface = "ens3";
serverIp = "51.79.240.130"; serverIp = "51.79.240.130";
forwarding = {
"80" = [ "10.100.0.2" "80" ];
"443" = [ "10.100.0.2" "443" ];
};
mapForwards = type:
builtins.concatStringsSep "\n" (
lib.mapAttrsToList (sport: tuple:
let
dest = builtins.head tuple;
dport = lib.last tuple;
in ''
${pkgs.iptables}/bin/iptables -${type} PREROUTING -t nat -i ${serverInterface} -p tcp --dport ${sport} -j DNAT --to ${dest}:${dport}
${pkgs.iptables}/bin/iptables -${type} FORWARD -p tcp -d ${dest} --dport ${dport} -j ACCEPT
'') forwarding
);
routeBypass = { routeBypass = {
caramel = { caramel = {
gateway = "192.168.100.1"; gateway = "192.168.100.1";
@ -52,6 +69,7 @@ let
internalInterfaces = [ "wg0" ]; internalInterfaces = [ "wg0" ];
}; };
firewall = { firewall = {
allowedTCPPorts = (builtins.map (s: lib.strings.toInt s) (builtins.attrNames forwarding));
allowedUDPPorts = [ port ]; allowedUDPPorts = [ port ];
}; };
@ -61,9 +79,11 @@ let
postSetup = '' postSetup = ''
${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.100.0.0/24 -o ${serverInterface} -j MASQUERADE ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.100.0.0/24 -o ${serverInterface} -j MASQUERADE
${mapForwards "A"}
''; '';
postShutdown = '' postShutdown = ''
${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.100.0.0/24 -o ${serverInterface} -j MASQUERADE ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.100.0.0/24 -o ${serverInterface} -j MASQUERADE
${mapForwards "D"}
''; '';
privateKeyFile = config.age.secrets."wg_${serverName}".path; privateKeyFile = config.age.secrets."wg_${serverName}".path;
@ -76,19 +96,18 @@ let
let let
client = clients."${config.networking.hostName}"; client = clients."${config.networking.hostName}";
routes = routeBypass."${config.networking.hostName}"; routes = routeBypass."${config.networking.hostName}";
mappedAdd = lib.concatMapStringsSep "\n" (r: "${pkgs.iproute2}/bin/ip route add ${r} via ${routes.gateway} dev ${routes.interface}") routes.routes; mapRoutes = type: lib.concatMapStringsSep "\n" (r: "${pkgs.iproute2}/bin/ip route ${type} ${r} via ${routes.gateway} dev ${routes.interface}") routes.routes;
mappedDel = lib.concatMapStringsSep "\n" (r: "${pkgs.iproute2}/bin/ip route del ${r} via ${routes.gateway} dev ${routes.interface}") routes.routes;
in { in {
ips = client.allowedIPs; ips = client.allowedIPs;
listenPort = port; listenPort = port;
postSetup = '' postSetup = ''
${mappedAdd} ${mapRoutes "add"}
${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.100.0.0/24 -o ${serverInterface} -j MASQUERADE ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.100.0.0/24 -o ${serverInterface} -j MASQUERADE
''; '';
postShutdown = '' postShutdown = ''
${mappedDel} ${mapRoutes "del"}
${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.100.0.0/24 -o ${serverInterface} -j MASQUERADE ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.100.0.0/24 -o ${serverInterface} -j MASQUERADE
''; '';