431e145992
- Introduced new configuration files for Linode host, including hardware configuration, toggles, and WireGuard settings. - Updated flake.nix to include the new images.nix file for Linode image generation. - Adjusted SSH key paths and secrets management for WireGuard to ensure proper integration with the new host setup. - Enhanced firewall rules and NAT configuration for WireGuard to improve security and connectivity.
73 lines
3.2 KiB
Nix
73 lines
3.2 KiB
Nix
{
|
|
config,
|
|
lib,
|
|
pkgs,
|
|
...
|
|
}:
|
|
{
|
|
config = lib.mkIf config.my.services.wireguard.enable {
|
|
sops.secrets."wireguard/linode/private" = {
|
|
sopsFile = ../../secrets/wireguard.yaml;
|
|
};
|
|
networking = {
|
|
nat = {
|
|
enable = true;
|
|
externalInterface = config.my.interfaces.${config.networking.hostName};
|
|
internalInterfaces = [ "wg0" ];
|
|
};
|
|
firewall = {
|
|
allowedUDPPorts = [ 51820 ];
|
|
extraCommands = ''
|
|
iptables -I FORWARD 1 -s ${config.my.ips.wg-friend1} -d ${config.my.ips.wg-server} -p tcp --dport 22000 -j ACCEPT
|
|
iptables -I FORWARD 2 -s ${config.my.ips.wg-server} -d ${config.my.ips.wg-friend1} -p tcp --sport 22000 -m state --state ESTABLISHED,RELATED -j ACCEPT
|
|
iptables -I FORWARD 3 -s ${config.my.ips.wg-friends}/24 -d 10.77.0.0/24 -j DROP
|
|
iptables -I FORWARD 4 -s 10.77.0.0/24 -d ${config.my.ips.wg-friends}/24 -j DROP
|
|
iptables -A FORWARD -s ${config.my.ips.wg-friends}/24 -o ${
|
|
config.my.interfaces.${config.networking.hostName}
|
|
} -j ACCEPT
|
|
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
|
|
'';
|
|
extraStopCommands = ''
|
|
iptables -D FORWARD -s ${config.my.ips.wg-friend1} -d ${config.my.ips.wg-server} -p tcp --dport 22000 -j ACCEPT 2>/dev/null || true
|
|
iptables -D FORWARD -s ${config.my.ips.wg-server} -d ${config.my.ips.wg-friend1} -p tcp --sport 22000 -m state --state ESTABLISHED,RELATED -j ACCEPT 2>/dev/null || true
|
|
iptables -D FORWARD -s ${config.my.ips.wg-friends}/24 -d 10.77.0.0/24 -j DROP 2>/dev/null || true
|
|
iptables -D FORWARD -s 10.77.0.0/24 -d ${config.my.ips.wg-friends}/24 -j DROP 2>/dev/null || true
|
|
iptables -D FORWARD -s ${config.my.ips.wg-friends}/24 -o ${
|
|
config.my.interfaces.${config.networking.hostName}
|
|
} -j ACCEPT 2>/dev/null || true
|
|
iptables -D FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT 2>/dev/null || true
|
|
'';
|
|
};
|
|
wireguard.interfaces.wg0 = {
|
|
ips = [
|
|
"${config.my.ips.wg-vps}/24"
|
|
"${config.my.ips.wg-friends}/24"
|
|
];
|
|
listenPort = 51820;
|
|
privateKeyFile = config.sops.secrets."wireguard/linode/private".path;
|
|
postSetup = "${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s ${config.my.ips.wg-friends}/24 -o ${
|
|
config.my.interfaces.${config.networking.hostName}
|
|
} -j MASQUERADE";
|
|
postShutdown = "${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s ${config.my.ips.wg-friends}/24 -o ${
|
|
config.my.interfaces.${config.networking.hostName}
|
|
} -j MASQUERADE 2>/dev/null || true";
|
|
peers = [
|
|
{
|
|
publicKey = "OUiqluRaS4hmGvLJ3csQrnIM3Zzet50gsqtTABaUkH4=";
|
|
allowedIPs = [ "${config.my.ips.wg-server}/32" ];
|
|
}
|
|
{
|
|
publicKey = "rFgT6TXzRazK6GMazMNGjtOvzAAPST0LvCfN7QXsLho=";
|
|
allowedIPs = [ "${config.my.ips.wg-friend1}/32" ];
|
|
}
|
|
];
|
|
};
|
|
};
|
|
boot.kernel.sysctl = {
|
|
"net.ipv4.ip_forward" = 1;
|
|
"net.ipv6.conf.all.forwarding" = 1;
|
|
};
|
|
environment.systemPackages = [ pkgs.wireguard-tools ];
|
|
};
|
|
}
|