nixos-config/hosts/defiant/services/wireguard.nix

44 lines
1.1 KiB
Nix
Raw Normal View History

2024-01-25 11:31:05 +01:00
{ config, pkgs, lib, ... }:
let
cfg = config.networking.wireguard.interfaces."wg0";
in {
networking = {
nat = {
enable = true;
externalInterface = "enp3s0";
internalInterfaces = [ "wg0" ];
};
firewall.allowedUDPPorts = [ cfg.listenPort ];
wireguard.interfaces."wg0" = {
ips = [ "10.100.0.1/24" ];
listenPort = 51820;
privateKeyFile = "/etc/wireguard/defiant.private";
2024-01-25 13:25:05 +01:00
postSetup = ''
${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.100.0.0/24 -d 192.168.10.0/24 -o eth0 -j MASQUERADE
'';
postShutdown = ''
${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.100.0.0/24 -d 192.168.10.0/24 -o eth0 -j MASQUERADE
'';
2024-01-25 11:31:05 +01:00
peers = [
{ # Burnham
publicKey = "JcfyrMoZmnbibVLaIKuGSARAX2alFv4kwLbJaLBNbzo=";
2024-01-25 13:25:05 +01:00
persistentKeepalive = 60;
2024-01-25 11:31:05 +01:00
allowedIPs = [
"10.100.0.2/32"
2024-01-25 13:25:05 +01:00
"192.168.11.0/24"
2024-01-25 11:31:05 +01:00
];
}
{ # Sulu
publicKey = "j6YVekgGS4nhL5zUiOTeK2BVQkYGlTQaiUpwcqQyfRk=";
allowedIPs = [
"10.100.0.3/32"
];
}
];
};
};
}