32 lines
1.1 KiB
Nix
32 lines
1.1 KiB
Nix
{ config, lib, pkgs, ... }: {
|
|
|
|
networking.nat.enable = true;
|
|
networking.nat.externalInterface = lib.head config.vars.interfaces;
|
|
networking.nat.internalInterfaces = [ "wg0" ] ++ config.vars.interfaces;
|
|
|
|
networking.wg-quick.interfaces = {
|
|
wg0 = {
|
|
address = [config.vars.wg_adress];
|
|
mtu = 1400;
|
|
autostart = true;
|
|
postUp = ''
|
|
${pkgs.procps}/bin/sysctl -w net.ipv4.conf.wg0.rp_filter=2
|
|
${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -o wg0 -d ${config.vars.wg_range} -j SNAT --to-source ${config.vars.local_ip}
|
|
'';
|
|
postDown = ''
|
|
${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -o wg0 -d ${config.vars.wg_range} -j SNAT --to-source ${config.vars.local_ip}
|
|
'';
|
|
privateKey = config.vars.wg_privateKey;
|
|
peers = [{
|
|
publicKey = config.vars.wg_publicKey;
|
|
presharedKey = config.vars.wg_presharedKey;
|
|
allowedIPs = [ config.vars.wg_range ];
|
|
endpoint = config.vars.wg_endpoint;
|
|
persistentKeepalive = 25;
|
|
}];
|
|
};
|
|
};
|
|
|
|
environment.systemPackages = [ pkgs.wireguard-tools ];
|
|
}
|