cilly/flakes
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

system/wireguard: add endpoint route

Browse source
This commit is contained in:
LavaDesu 2022-02-02 20:50:59 +07:00
parent 9a265bba77
commit 52e3ed6ad5
Signed by: cilly
GPG key ID: 6500251E087653C9
1 changed files with 19 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

22
modules/system/wireguard.nix
View file

@ -3,11 +3,14 @@ let
port = 51820; port = 51820;
serverName = "sugarcane"; serverName = "sugarcane";
serverInterface = "ens3"; serverInterface = "ens3";
serverIp = "51.79.240.130";
clients = { clients = {
blossom = { blossom = {
publicKey = "6nVhazYdmC15A/nke9VrqIg3sOBVOmqj4GEsyBq7MVo="; publicKey = "6nVhazYdmC15A/nke9VrqIg3sOBVOmqj4GEsyBq7MVo=";
allowedIPs = [ "10.100.0.3/32" ]; allowedIPs = [ "10.100.0.3/32" ];
interface = "wlp3s0";
gateway = "192.168.100.1";
}; };
strawberry = { strawberry = {
publicKey = "Fkcp/VSN4Dkhly8V4hskF4lnDviA7VZHCnWf7OliFCg="; publicKey = "Fkcp/VSN4Dkhly8V4hskF4lnDviA7VZHCnWf7OliFCg=";
@ -19,7 +22,7 @@ let
serverPeer = { serverPeer = {
publicKey = "3ugIk2tQZXjAH9/95s63ld2WNUHQrd4Mz5jzbln6oj0="; publicKey = "3ugIk2tQZXjAH9/95s63ld2WNUHQrd4Mz5jzbln6oj0=";
allowedIPs = [ "0.0.0.0/0" ]; allowedIPs = [ "0.0.0.0/0" ];
endpoint = "sugarcane.lava.moe:${toString port}"; endpoint = "${serverIp}:${toString port}";
persistentKeepalive = 25; persistentKeepalive = 25;
}; };
@ -50,10 +53,23 @@ let
}; };
clientConfig = { clientConfig = {
wireguard.interfaces.wg0 = { wireguard.interfaces.wg0 =
ips = clients."${config.networking.hostName}".allowedIPs; let
client = clients."${config.networking.hostName}";
in {
ips = client.allowedIPs;
listenPort = port; listenPort = port;
postSetup = ''
${pkgs.iproute2}/bin/ip route add ${serverIp} via ${client.gateway} dev ${client.interface}
${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.100.0.0/24 -o ${serverInterface} -j MASQUERADE
'';
postShutdown = ''
${pkgs.iproute2}/bin/ip route del ${serverIp} via ${client.gateway} dev ${client.interface}
${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.100.0.0/24 -o ${serverInterface} -j MASQUERADE
'';
privateKeyFile = config.age.secrets."wg_${config.networking.hostName}".path; privateKeyFile = config.age.secrets."wg_${config.networking.hostName}".path;
peers = [ serverPeer ]; peers = [ serverPeer ];
}; };