summaryrefslogtreecommitdiffstats
path: root/makefu/1systems/gum/config.nix
diff options
context:
space:
mode:
authormakefu <github@syntax-fehler.de>2018-01-06 20:51:32 +0100
committermakefu <github@syntax-fehler.de>2018-01-06 20:51:32 +0100
commit72d8ea37cc19a0d09dedef55d540c6b06ebcdbd1 (patch)
treee0008b303229b0deb934522bda13183f7b0af5d0 /makefu/1systems/gum/config.nix
parent7b39418eb059a80b365beba867613ea0e378c189 (diff)
ma gum.r: add vbob to wireguard
Diffstat (limited to 'makefu/1systems/gum/config.nix')
-rw-r--r--makefu/1systems/gum/config.nix27
1 files changed, 23 insertions, 4 deletions
diff --git a/makefu/1systems/gum/config.nix b/makefu/1systems/gum/config.nix
index 1fe0b62f9..6e5f3c2d4 100644
--- a/makefu/1systems/gum/config.nix
+++ b/makefu/1systems/gum/config.nix
@@ -108,16 +108,35 @@ in {
# };
#}
{ # wireguard server
- networking.firewall.allowedUDPPorts = [ 51820 ];
+
+ # TODO: networking.nat
+
+ # boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
+ # conf.all.proxy_arp =1
+ networking.firewall = {
+ allowedUDPPorts = [ 51820 ];
+ extraCommands = ''
+ iptables -t nat -A POSTROUTING -s 10.244.0.0/24 -o ${ext-if} -j MASQUERADE
+ '';
+ };
+
networking.wireguard.interfaces.wg0 = {
ips = [ "10.244.0.1/24" ];
+ listenPort = 51820;
privateKeyFile = (toString <secrets>) + "/wireguard.key";
allowedIPsAsRoutes = true;
- peers = [{
- # allowedIPs = [ "0.0.0.0/0" "::/0" ];
+ peers = [
+ {
+ # x
allowedIPs = [ "10.244.0.2/32" ];
publicKey = "fe5smvKVy5GAn7EV4w4tav6mqIAKhGWQotm7dRuRt1g=";
- }];
+ }
+ {
+ # vbob
+ allowedIPs = [ "10.244.0.3/32" ];
+ publicKey = "Lju7EsCu1OWXhkhdNR7c/uiN60nr0TUPHQ+s8ULPQTw=";
+ }
+ ];
};
}