infrastructure/hosts/phoenix.lewd.wtf/networking.nix

80 lines
2.3 KiB
Nix

{ pkgs, ... }:
{
networking.useDHCP = false;
networking.bridges = {
"br0" = {
interfaces = [
"eno2"
"enp23s0"
"enp23s0d1"
];
};
};
networking.nat = {
enable = true;
internalInterfaces = ["ve-+"];
externalInterface = "br0";
enableIPv6 = true;
};
networking.interfaces.br0.ipv4.addresses = [
{
address = "10.0.69.69";
prefixLength = 16;
}
{
address = "192.168.0.42";
prefixLength = 22;
}
];
networking.defaultGateway = "10.0.0.1";
# networking.defaultGateway = "192.168.0.1";
networking.nameservers = [ "1.1.1.1" ];
networking.firewall.enable = false;
networking.wireguard.interfaces = {
wg0 = {
ips = [ "10.175.197.82/32" "fd7d:76ee:e68f:a993:f6b2:9dab:ddd3:a02/128" ];
privateKeyFile = "/run/secrets/services/wireguard/airvpn.private";
allowedIPsAsRoutes = false;
peers = [
{
publicKey = "PyLCXAQT8KkM4T+dUsOQfn+Ub3pGxfGlxkIApuig+hk=";
presharedKeyFile = "/run/secrets/services/wireguard/airvpn.psk";
allowedIPs = [ "0.0.0.0/0" ];
endpoint = "134.19.179.213:1637";
persistentKeepalive = 25;
}
];
postSetup = [
# Force traffic from container networks through wg0
"ip route add table 2 default dev wg0"
"ip rule add from 192.168.100.0/24 table 2"
"ip rule add from 192.168.5.0/24 table 2"
# NAT
"${pkgs.iptables}/bin/iptables -I POSTROUTING -t nat -o wg0 -j MASQUERADE"
# c3moc NAT
"${pkgs.iptables}/bin/iptables -I POSTROUTING -t nat -o br0 -j MASQUERADE"
# Port forwarding
"${pkgs.iptables}/bin/iptables -A PREROUTING -t nat -p tcp -i wg0 --dport 51506 -j DNAT --to-destination 192.168.100.11:51506"
];
};
};
systemd.services.wireguard-wg0.preStop =
# Force traffic from container networks through wg0
"ip rule del from 192.168.100.0/24 table 2" +
"ip rule del from 192.168.5.0/24 table 2" +
"ip route del table 2 default dev wg0" +
# NAT
"${pkgs.iptables}/bin/iptables -D POSTROUTING -t nat -o wg0 -j MASQUERADE" +
# c3moc NAT
"${pkgs.iptables}/bin/iptables -D POSTROUTING -t nat -o br0 -j MASQUERADE" +
# Port Forwarding
"${pkgs.iptables}/bin/iptables -D PREROUTING -t nat -p tcp -i wg0 --dport 51506 -j DNAT --to-destination 192.168.100.11:51506"
;
}