Compare commits
1 Commits
Author | SHA1 | Date | |
---|---|---|---|
00d8632870 |
@ -42,11 +42,11 @@ toplevel @ { moduleWithSystem, ... }: {
|
|||||||
ssh = {
|
ssh = {
|
||||||
matchBlocks = {
|
matchBlocks = {
|
||||||
vpsfree-ivand = {
|
vpsfree-ivand = {
|
||||||
hostname = "10.0.0.1";
|
hostname = "10.69.69.1";
|
||||||
user = "ivand";
|
user = "ivand";
|
||||||
};
|
};
|
||||||
vpsfree-root = {
|
vpsfree-root = {
|
||||||
hostname = "10.0.0.1";
|
hostname = "10.69.69.1";
|
||||||
user = "root";
|
user = "root";
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
@ -151,7 +151,7 @@ top @ { inputs, moduleWithSystem, ... }: {
|
|||||||
intranet = {
|
intranet = {
|
||||||
networking.wg-quick.interfaces = {
|
networking.wg-quick.interfaces = {
|
||||||
wg0 = {
|
wg0 = {
|
||||||
address = [ "10.0.0.2/32" ];
|
address = [ "10.69.69.2/24" ];
|
||||||
privateKeyFile = "/etc/wireguard/privatekey";
|
privateKeyFile = "/etc/wireguard/privatekey";
|
||||||
peers = [
|
peers = [
|
||||||
{
|
{
|
||||||
@ -359,9 +359,9 @@ top @ { inputs, moduleWithSystem, ... }: {
|
|||||||
nginx.virtualHosts =
|
nginx.virtualHosts =
|
||||||
let
|
let
|
||||||
restrictToVpn = ''
|
restrictToVpn = ''
|
||||||
allow 10.0.0.2/32;
|
allow 10.69.69.2/24;
|
||||||
allow 10.0.0.3/32;
|
allow 10.69.69.3/24;
|
||||||
allow 10.0.0.4/32;
|
allow 10.69.69.4/24;
|
||||||
deny all;
|
deny all;
|
||||||
'';
|
'';
|
||||||
in
|
in
|
||||||
@ -475,50 +475,72 @@ top @ { inputs, moduleWithSystem, ... }: {
|
|||||||
});
|
});
|
||||||
wireguard-output = moduleWithSystem (_: { pkgs, ... }: {
|
wireguard-output = moduleWithSystem (_: { pkgs, ... }: {
|
||||||
networking = {
|
networking = {
|
||||||
|
useNetworkd = true;
|
||||||
nat = {
|
nat = {
|
||||||
enable = true;
|
enable = true;
|
||||||
enableIPv6 = true;
|
enableIPv6 = true;
|
||||||
externalInterface = "venet0";
|
externalInterface = "venet0";
|
||||||
internalInterfaces = [ "wg0" ];
|
internalInterfaces = [ "wg0" ];
|
||||||
};
|
};
|
||||||
wg-quick.interfaces = {
|
# wg-quick.interfaces = {
|
||||||
wg0 =
|
# wg0 =
|
||||||
let
|
# let
|
||||||
iptables = "${pkgs.iptables}/bin/iptables";
|
# iptables = "${pkgs.iptables}/bin/iptables";
|
||||||
ip6tables = "${pkgs.iptables}/bin/ip6tables";
|
# ip6tables = "${pkgs.iptables}/bin/ip6tables";
|
||||||
in
|
# in
|
||||||
|
# {
|
||||||
|
# privateKeyFile = "";
|
||||||
|
# postUp = ''
|
||||||
|
# ${iptables} -A FORWARD -i wg0 -j ACCEPT
|
||||||
|
# ${iptables} -t nat -A POSTROUTING -s 10.69.69.1/24 -o venet0 -j MASQUERADE
|
||||||
|
# ${ip6tables} -A FORWARD -i wg0 -j ACCEPT
|
||||||
|
# ${ip6tables} -t nat -A POSTROUTING -s fdc9:281f:04d7:9ee9::1/64 -o venet0 -j MASQUERADE
|
||||||
|
# '';
|
||||||
|
# preDown = ''
|
||||||
|
# ${iptables} -D FORWARD -i wg0 -j ACCEPT
|
||||||
|
# ${iptables} -t nat -D POSTROUTING -s 10.69.69.1/24 -o venet0 -j MASQUERADE
|
||||||
|
# ${ip6tables} -D FORWARD -i wg0 -j ACCEPT
|
||||||
|
# ${ip6tables} -t nat -D POSTROUTING -s fdc9:281f:04d7:9ee9::1/64 -o venet0 -j MASQUERADE
|
||||||
|
# '';
|
||||||
|
# };
|
||||||
|
# };
|
||||||
|
};
|
||||||
|
systemd.network = {
|
||||||
|
enable = true;
|
||||||
|
netdevs = {
|
||||||
|
"50-wg0" = {
|
||||||
|
netdevConfig = {
|
||||||
|
Kind = "wireguard";
|
||||||
|
Name = "wg0";
|
||||||
|
MTUBytes = "1300";
|
||||||
|
};
|
||||||
|
wireguardConfig = {
|
||||||
|
PrivateKeyFile = "/etc/wireguard/privatekey";
|
||||||
|
ListenPort = 51820;
|
||||||
|
};
|
||||||
|
wireguardPeers = [
|
||||||
{
|
{
|
||||||
address = [ "10.0.0.1/32" ];
|
PublicKey = "kI93V0dVKSqX8hxMJHK5C0c1hEDPQTgPQDU8TKocVgo=";
|
||||||
listenPort = 51820;
|
AllowedIPs = [ "10.69.69.2/24" ];
|
||||||
privateKeyFile = "/etc/wireguard/privatekey";
|
|
||||||
postUp = ''
|
|
||||||
${iptables} -A FORWARD -i wg0 -j ACCEPT
|
|
||||||
${iptables} -t nat -A POSTROUTING -s 10.0.0.1/24 -o venet0 -j MASQUERADE
|
|
||||||
${ip6tables} -A FORWARD -i wg0 -j ACCEPT
|
|
||||||
${ip6tables} -t nat -A POSTROUTING -s fdc9:281f:04d7:9ee9::1/64 -o venet0 -j MASQUERADE
|
|
||||||
'';
|
|
||||||
preDown = ''
|
|
||||||
${iptables} -D FORWARD -i wg0 -j ACCEPT
|
|
||||||
${iptables} -t nat -D POSTROUTING -s 10.0.0.1/24 -o venet0 -j MASQUERADE
|
|
||||||
${ip6tables} -D FORWARD -i wg0 -j ACCEPT
|
|
||||||
${ip6tables} -t nat -D POSTROUTING -s fdc9:281f:04d7:9ee9::1/64 -o venet0 -j MASQUERADE
|
|
||||||
'';
|
|
||||||
peers = [
|
|
||||||
{
|
|
||||||
publicKey = "kI93V0dVKSqX8hxMJHK5C0c1hEDPQTgPQDU8TKocVgo=";
|
|
||||||
allowedIPs = [ "10.0.0.2/32" ];
|
|
||||||
}
|
}
|
||||||
{
|
{
|
||||||
publicKey = "RqTsFxFCcgYsytcDr+jfEoOA5UNxa1ZzGlpx6iuTpXY=";
|
PublicKey = "RqTsFxFCcgYsytcDr+jfEoOA5UNxa1ZzGlpx6iuTpXY=";
|
||||||
allowedIPs = [ "10.0.0.3/32" ];
|
AllowedIPs = [ "10.69.69.3/24" ];
|
||||||
}
|
}
|
||||||
{
|
{
|
||||||
publicKey = "1e0mjluqXdLbzv681HlC9B8BfGN8sIXIw3huLyQqwXI=";
|
PublicKey = "1e0mjluqXdLbzv681HlC9B8BfGN8sIXIw3huLyQqwXI=";
|
||||||
allowedIPs = [ "10.0.0.4/32" ];
|
AllowedIPs = [ "10.69.69.4/24" ];
|
||||||
}
|
}
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
networks.wg0 = {
|
||||||
|
matchConfig.Name = "wg0";
|
||||||
|
address = [ "10.69.69.1/24" ];
|
||||||
|
networkConfig = {
|
||||||
|
IPMasquerade = "ipv4";
|
||||||
|
};
|
||||||
|
};
|
||||||
};
|
};
|
||||||
});
|
});
|
||||||
anonymous-dns = moduleWithSystem (_: _: {
|
anonymous-dns = moduleWithSystem (_: _: {
|
||||||
@ -578,9 +600,9 @@ top @ { inputs, moduleWithSystem, ... }: {
|
|||||||
];
|
];
|
||||||
extraCommands = ''
|
extraCommands = ''
|
||||||
iptables -N vpn # create a new chain named vpn
|
iptables -N vpn # create a new chain named vpn
|
||||||
iptables -A vpn --src 10.0.0.2 -j ACCEPT # allow
|
iptables -A vpn --src 10.69.69.2 -j ACCEPT # allow
|
||||||
iptables -A vpn --src 10.0.0.3 -j ACCEPT # allow
|
iptables -A vpn --src 10.69.69.3 -j ACCEPT # allow
|
||||||
iptables -A vpn --src 10.0.0.4 -j ACCEPT # allow
|
iptables -A vpn --src 10.69.69.4 -j ACCEPT # allow
|
||||||
iptables -A vpn -j DROP # drop everyone else
|
iptables -A vpn -j DROP # drop everyone else
|
||||||
iptables -I INPUT -m tcp -p tcp --dport 22 -j vpn
|
iptables -I INPUT -m tcp -p tcp --dport 22 -j vpn
|
||||||
'';
|
'';
|
||||||
|
Loading…
Reference in New Issue
Block a user