{ config, pkgs, lib, ... }: let cfg = config.networking.wireguard.interfaces."wg0"; in { networking = { nat = { enable = true; externalInterface = "ens18"; internalInterfaces = [ "wg0" ]; }; firewall.allowedUDPPorts = [ cfg.listenPort ]; wireguard.interfaces."wg0" = { ips = [ "10.100.0.2/24" ]; listenPort = 51820; privateKeyFile = "/etc/wireguard/burnham.private"; postSetup = '' ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.100.0.0/24 -d 192.168.11.0/24 -o eth0 -j MASQUERADE ''; postShutdown = '' ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.100.0.0/24 -d 192.168.11.0/24 -o eth0 -j MASQUERADE ''; peers = [ { # Defiant publicKey = "8/711GhmN9+NcduHF4JPkfoZPE0qsDLuwhABcPyjNxI="; persistentKeepalive = 120; allowedIPs = [ "10.100.0.1/32" "192.168.10.0/24" ]; endpoint = "site3.feal.no:51902"; } { # Worf publicKey = "kW8SyzCh2tw8GzZV6bPn+IQVNUoUhseNfEm3rHnR1So="; allowedIPs = [ "10.100.0.4/32" ]; } { # Phone publicKey = "axFXtcTYtW6m1FT9Czn9DRvG+b05D7j+0yRMjn/FJEk="; allowedIPs = [ "10.100.0.5/32" ]; } ]; }; }; }