95 lines
2.5 KiB
Nix
95 lines
2.5 KiB
Nix
{
|
|
config,
|
|
lib,
|
|
vars,
|
|
...
|
|
}: let
|
|
peers = vars.hosts.rackserv.wireguardPeers;
|
|
in {
|
|
networking.firewall = let
|
|
externalIp = "172.245.52.19";
|
|
b = builtins;
|
|
isIpv4 = ip: b.match "([0-9]{1,3}\.){3}[0-9]{1,3}" ip != null;
|
|
forPortIps = f:
|
|
lib.concatStrings (
|
|
b.concatMap (
|
|
peer:
|
|
lib.cartesianProduct {
|
|
IP = peer.IPs;
|
|
port = peer.OpenPorts;
|
|
}
|
|
|> b.filter (x: isIpv4 x.IP)
|
|
|> map f
|
|
)
|
|
peers
|
|
);
|
|
getPortsWithProtocol = protocol:
|
|
b.concatMap (peer:
|
|
peer.OpenPorts
|
|
|> b.filter (portInfo: portInfo.protocol == protocol)
|
|
|> map (portInfo: portInfo.port))
|
|
peers;
|
|
in {
|
|
allowedTCPPorts = getPortsWithProtocol "tcp";
|
|
allowedUDPPorts = getPortsWithProtocol "udp";
|
|
extraCommands = forPortIps ({
|
|
IP,
|
|
port,
|
|
}: ''
|
|
iptables -t nat -A PREROUTING -p ${port.protocol} -d ${externalIp} --dport ${toString port.port} -j DNAT --to-destination ${IP}
|
|
iptables -t nat -A POSTROUTING -p ${port.protocol} -d ${IP} --dport ${toString port.port} -j SNAT --to-source ${externalIp}
|
|
'');
|
|
extraStopCommands = forPortIps ({
|
|
IP,
|
|
port,
|
|
}: ''
|
|
iptables -t nat -D PREROUTING -p ${port.protocol} -d ${externalIp} --dport ${toString port.port} -j DNAT --to-destination ${IP} || true
|
|
iptables -t nat -D POSTROUTING -p ${port.protocol} -d ${IP} --dport ${toString port.port} -j SNAT --to-source ${externalIp} || true
|
|
'');
|
|
|
|
interfaces.wg0 = {
|
|
allowedUDPPorts = [53];
|
|
allowedTCPPorts = [53];
|
|
};
|
|
};
|
|
|
|
systemd.network.netdevs = {
|
|
"50-wg0" = {
|
|
netdevConfig = {
|
|
Kind = "wireguard";
|
|
Name = "wg0";
|
|
MTUBytes = "1420";
|
|
};
|
|
wireguardConfig = {
|
|
ListenPort = 51820;
|
|
PrivateKeyFile = config.sops.secrets.wireguard-privatekey.path;
|
|
RouteTable = "main";
|
|
};
|
|
wireguardPeers =
|
|
map (peer: {
|
|
inherit (peer) PublicKey;
|
|
AllowedIPs = peer.IPs;
|
|
})
|
|
peers;
|
|
};
|
|
};
|
|
|
|
systemd.network.networks.wg0 = {
|
|
matchConfig.Name = "wg0";
|
|
address = ["10.0.0.1/10" "fd12:1e51:ca23::1/64"];
|
|
networkConfig = {
|
|
IPMasquerade = "ipv4";
|
|
IPv4Forwarding = true;
|
|
};
|
|
};
|
|
|
|
services.dnsmasq = {
|
|
enable = true;
|
|
resolveLocalQueries = false;
|
|
settings = {
|
|
server = ["1.1.1.1" "8.8.8.8"];
|
|
interface = ["wg0"];
|
|
bind-interfaces = true;
|
|
};
|
|
};
|
|
}
|