blob: 5703f3d72e0d5b1f9b012dfd50cdb5add499ef2b (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
|
{ lib, config, pkgs, ... }:
/*
Wireguard VPN server
References:
- https://nixos.wiki/wiki/WireGuard
- https://wireguard.how/client/ios/
*/
let
ports = import ../Cloud/Ports.nix;
ips = "10.100.0.1/24";
# a micro-library for creating iptables rules
iptables = rec {
bin = "${pkgs.iptables/bin/iptables}";
append = {source}: lib.concatSep " " [
bin
"--table" "nat"
"--append" "POSTROUTING"
"--source" source
"--out-interface" "eth0"
"--jump" "MASQUERADE"
];
delete = {source}: lib.concatSep " " [
bin
"--table" "nat"
"--delete" "POSTROUTING"
"--source" source
"--out-interface" "eth0"
"--jump" "MASQUERADE"
];
};
in {
networking.nat.enable = true;
networking.nat.externalInterface = "eth0";
networking.nat.internalInterfaces = [ "wg0" ];
networking.firewall.allowedUDPPorts = [ ports.wireguard ];
networking.wireguard.enable = true;
networking.wireguard.interfaces = {
wg0 = {
ips = [ ips ];
allowedIPsAsRoutes = true;
listenPort = ports.wireguard;
postSetup = ''
${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s ${ips} -o eth0 -j MASQUERADE
'';
postShutdown = ''
${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s ${ips} -o eth0 -j MASQUERADE
'';
privateKeyFile = "/var/wireguard/private";
peers = [
#{ # helium
# publicKey = "TODO";
# allowedIPs = [ "10.100.0.2/32" ];
#}
{ # ben's iPhone
publicKey = "SIBIfPLhzuV1S1FZtm5JQtDbl0ehnH+Y3CpoZ2eZ3gc=";
allowedIPs = [ "10.100.0.3/32" ];
}
];
};
};
}
|
