ivandimitrov8080/mail.idimitrov.dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

wireguard change config

Browse Source
This commit is contained in:
Ivan Dimitrov 2023-11-18 17:59:08 +02:00
parent 7a31488abd
commit 71604917c1
2 changed files with 37 additions and 32 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
mailserver/configuration.nix
View File

@ -16,7 +16,11 @@
};
};
networking.firewall.allowedTCPPorts = [ 80 443 ];
networking.firewall = {
enable = true;
allowedTCPPorts = [ 53 80 443 ];
allowedUDPPorts = [ 53 51820 ];
};
users = {
users.ivand = {
@ -34,7 +38,7 @@
};
environment = {
systemPackages = with pkgs; [ coreutils-full fd git vim mlocate busybox bash scripts ];
systemPackages = with pkgs; [ nmap coreutils-full fd git vim mlocate busybox bash scripts ];
};
services = {

39
mailserver/wireguard.nix
View File

@ -1,34 +1,35 @@
{ pkgs, ... }: {
networking = {
nat = {
networking.nat = {
enable = true;
externalInterface = "eth0";
enableIPv6 = true;
externalInterface = "venet0";
internalInterfaces = [ "wg0" ];
};
firewall = {
allowedUDPPorts = [ 51820 ];
};
wireguard.interfaces = {
networking.wg-quick.interfaces = {
wg0 = {
ips = [ "10.100.0.1/24" ];
address = [ "10.0.0.1/24" "fdc9:281f:04d7:9ee9::1/64" ];
listenPort = 51820;
postSetup = ''
${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.100.0.0/24 -o eth0 -j MASQUERADE
'';
postShutdown = ''
${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.100.0.0/24 -o eth0 -j MASQUERADE
'';
privateKeyFile = "/etc/wireguard/privatekey";
generatePrivateKeyFile = true;
postUp = ''
${pkgs.iptables}/bin/iptables -A FORWARD -i wg0 -j ACCEPT
${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.0.0.1/24 -o venet0 -j MASQUERADE
${pkgs.iptables}/bin/ip6tables -A FORWARD -i wg0 -j ACCEPT
${pkgs.iptables}/bin/ip6tables -t nat -A POSTROUTING -s fdc9:281f:04d7:9ee9::1/64 -o venet0 -j MASQUERADE
'';
preDown = ''
${pkgs.iptables}/bin/iptables -D FORWARD -i wg0 -j ACCEPT
${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.0.0.1/24 -o venet0 -j MASQUERADE
${pkgs.iptables}/bin/ip6tables -D FORWARD -i wg0 -j ACCEPT
${pkgs.iptables}/bin/ip6tables -t nat -D POSTROUTING -s fdc9:281f:04d7:9ee9::1/64 -o venet0 -j MASQUERADE
'';
peers = [
{
publicKey = "28yXYLk4U0r6MdWFEZzk6apI8uhg962wMprF47wUJyI=";
allowedIPs = [ "10.100.0.2/32" ];
allowedIPs = [ "10.0.0.2/32" "fdc9:281f:04d7:9ee9::2/128" ];
}
];
};
};
};
}