summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authormakefu <github@syntax-fehler.de>2023-03-22 23:18:23 +0100
committermakefu <github@syntax-fehler.de>2023-03-22 23:18:23 +0100
commit48c3746cf09aedf888692856e33f9a803ae37829 (patch)
tree7f978434a9ee575c9ac387c46e2586278416578a
parentcaa8f83e79f7373bf234874b8614117c3f7a0710 (diff)
ma wiregrill: also masquerade ipv6
-rw-r--r--makefu/2configs/wireguard/wiregrill.nix18
1 files changed, 17 insertions, 1 deletions
diff --git a/makefu/2configs/wireguard/wiregrill.nix b/makefu/2configs/wireguard/wiregrill.nix
index 082090755..dbe3a91c1 100644
--- a/makefu/2configs/wireguard/wiregrill.nix
+++ b/makefu/2configs/wireguard/wiregrill.nix
@@ -13,16 +13,32 @@ in mkIf (hasAttr "wiregrill" config.krebs.build.host.nets) {
boot.kernel.sysctl = mkIf isRouter {
"net.ipv6.conf.all.forwarding" = 1;
+ "net.ipv4.conf.all.forwarding" = 1;
+ };
+ networking.nat = {
+ enable = true;
+ externalInterface = ext-if;
+ internalInterfaces = [ "wiregrill" ];
};
networking.firewall = {
allowedUDPPorts = [ self.wireguard.port ];
extraCommands = ''
- iptables -A FORWARD -i wiregrill -o wiregrill -j ACCEPT
+ ${pkgs.iptables}/bin/iptables -A FORWARD -i wiregrill -o wiregrill -j ACCEPT
'';
};
networking.wireguard.interfaces.wiregrill = {
+ postSetup = ''
+ ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.220.245.0/24 -o ${ext-if} -j MASQUERADE
+ ${pkgs.iptables}/bin/ip6tables -t nat -A POSTROUTING -s 42::/16 -o ${ext-if} -j MASQUERADE
+ '';
+
+ # This undoes the above command
+ postShutdown = ''
+ ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.244.245.0/24 -o ${ext-if} -j MASQUERADE
+ ${pkgs.iptables}/bin/ip6tables -t nat -D POSTROUTING -s 42::/16 -o ${ext-if} -j MASQUERADE
+ '';
ips =
(optional (!isNull self.ip4) self.ip4.addr) ++
(optional (!isNull self.ip6) self.ip6.addr);