ivandimitrov8080/mail.idimitrov.dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

wireguard change config

Browse Source
This commit is contained in:
Ivan Dimitrov 2023-11-18 17:59:08 +02:00
parent 7a31488abd
commit 71604917c1
2 changed files with 37 additions and 32 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
mailserver/configuration.nix
View File

@ -16,7 +16,11 @@
}; };
}; };
networking.firewall.allowedTCPPorts = [ 80 443 ]; networking.firewall = {
enable = true;
allowedTCPPorts = [ 53 80 443 ];
allowedUDPPorts = [ 53 51820 ];
};
users = { users = {
users.ivand = { users.ivand = {
@ -34,7 +38,7 @@
}; };
environment = { environment = {
systemPackages = with pkgs; [ coreutils-full fd git vim mlocate busybox bash scripts ]; systemPackages = with pkgs; [ nmap coreutils-full fd git vim mlocate busybox bash scripts ];
}; };
services = { services = {

39
mailserver/wireguard.nix
View File

@ -1,34 +1,35 @@
{ pkgs, ... }: { { pkgs, ... }: {
networking = {
nat = { networking.nat = {
enable = true; enable = true;
externalInterface = "eth0"; enableIPv6 = true;
externalInterface = "venet0";
internalInterfaces = [ "wg0" ]; internalInterfaces = [ "wg0" ];
}; };
firewall = {
allowedUDPPorts = [ 51820 ]; networking.wg-quick.interfaces = {
};
wireguard.interfaces = {
wg0 = { wg0 = {
ips = [ "10.100.0.1/24" ]; address = [ "10.0.0.1/24" "fdc9:281f:04d7:9ee9::1/64" ];
listenPort = 51820; listenPort = 51820;
postSetup = ''
${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.100.0.0/24 -o eth0 -j MASQUERADE
'';
postShutdown = ''
${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.100.0.0/24 -o eth0 -j MASQUERADE
'';
privateKeyFile = "/etc/wireguard/privatekey"; privateKeyFile = "/etc/wireguard/privatekey";
generatePrivateKeyFile = true; postUp = ''
${pkgs.iptables}/bin/iptables -A FORWARD -i wg0 -j ACCEPT
${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.0.0.1/24 -o venet0 -j MASQUERADE
${pkgs.iptables}/bin/ip6tables -A FORWARD -i wg0 -j ACCEPT
${pkgs.iptables}/bin/ip6tables -t nat -A POSTROUTING -s fdc9:281f:04d7:9ee9::1/64 -o venet0 -j MASQUERADE
'';
preDown = ''
${pkgs.iptables}/bin/iptables -D FORWARD -i wg0 -j ACCEPT
${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.0.0.1/24 -o venet0 -j MASQUERADE
${pkgs.iptables}/bin/ip6tables -D FORWARD -i wg0 -j ACCEPT
${pkgs.iptables}/bin/ip6tables -t nat -D POSTROUTING -s fdc9:281f:04d7:9ee9::1/64 -o venet0 -j MASQUERADE
'';
peers = [ peers = [
{ {
publicKey = "28yXYLk4U0r6MdWFEZzk6apI8uhg962wMprF47wUJyI="; publicKey = "28yXYLk4U0r6MdWFEZzk6apI8uhg962wMprF47wUJyI=";
allowedIPs = [ "10.100.0.2/32" ]; allowedIPs = [ "10.0.0.2/32" "fdc9:281f:04d7:9ee9::2/128" ];
} }
]; ];
}; };
}; };
};
} }