summaryrefslogtreecommitdiffstats
path: root/makefu/2configs/wireguard/wiregrill.nix
diff options
context:
space:
mode:
authormakefu <github@syntax-fehler.de>2023-03-23 01:10:21 +0100
committermakefu <github@syntax-fehler.de>2023-03-23 01:10:21 +0100
commit55b00f7139d07469d6be3037d2443850b6d7496c (patch)
tree74b177a434ddddca247bec1827f988c99de55527 /makefu/2configs/wireguard/wiregrill.nix
parent1d1eb043d19a9f1b0c8e8faebede7842a45dabf5 (diff)
ma wiregrill: allow masquerading between wiregrill/retiolum
Diffstat (limited to 'makefu/2configs/wireguard/wiregrill.nix')
-rw-r--r--makefu/2configs/wireguard/wiregrill.nix43
1 files changed, 34 insertions, 9 deletions
diff --git a/makefu/2configs/wireguard/wiregrill.nix b/makefu/2configs/wireguard/wiregrill.nix
index dbe3a91c1..070f01e10 100644
--- a/makefu/2configs/wireguard/wiregrill.nix
+++ b/makefu/2configs/wireguard/wiregrill.nix
@@ -15,30 +15,55 @@ in mkIf (hasAttr "wiregrill" config.krebs.build.host.nets) {
"net.ipv6.conf.all.forwarding" = 1;
"net.ipv4.conf.all.forwarding" = 1;
};
- networking.nat = {
+ networking.nat = mkIf isRouter {
enable = true;
+ enableIPv6 = true;
externalInterface = ext-if;
internalInterfaces = [ "wiregrill" ];
};
networking.firewall = {
allowedUDPPorts = [ self.wireguard.port ];
- extraCommands = ''
- ${pkgs.iptables}/bin/iptables -A FORWARD -i wiregrill -o wiregrill -j ACCEPT
+ interfaces.wiregrill = mkIf isRouter {
+ allowedUDPPorts = [ 53 ];
+ allowedTCPPorts = [ 53 ];
+ };
+ };
+
+ services.dnsmasq = mkIf isRouter {
+ enable = true;
+ resolveLocalQueries = false;
+ extraConfig = /* dnsmasq */ ''
+ bind-interfaces
+ interface=retiolum,wiregrill
'';
+ servers = [ "1.1.1.1" ];
};
networking.wireguard.interfaces.wiregrill = {
- postSetup = ''
- ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.220.245.0/24 -o ${ext-if} -j MASQUERADE
- ${pkgs.iptables}/bin/ip6tables -t nat -A POSTROUTING -s 42::/16 -o ${ext-if} -j MASQUERADE
+ postSetup = optionalString isRouter ''
+ ${pkgs.iptables}/bin/iptables -t nat -A PREROUTING -s 10.244.245.0/24 -j ACCEPT
+ ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.244.245.0/24 ! -d 10.244.245.0/24 -j MASQUERADE
+ ${pkgs.iptables}/bin/iptables -A FORWARD -i wiregrill -o retiolum -j ACCEPT
+ ${pkgs.iptables}/bin/iptables -A FORWARD -i retiolum -o wiregrill -j ACCEPT
+
+ ${pkgs.iptables}/bin/ip6tables -t nat -A PREROUTING -s 42:1::/32 -j ACCEPT
+ ${pkgs.iptables}/bin/ip6tables -t nat -A POSTROUTING -s 42:1::/32 ! -d 42:1::/48 -j MASQUERADE
+ ${pkgs.iptables}/bin/ip6tables -A FORWARD -i wiregrill -o retiolum -j ACCEPT
+ ${pkgs.iptables}/bin/ip6tables -A FORWARD -i retiolum -o wiregrill -j ACCEPT
'';
# This undoes the above command
- postShutdown = ''
+ postShutdown = optionalString isRouter ''
${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.244.245.0/24 -o ${ext-if} -j MASQUERADE
- ${pkgs.iptables}/bin/ip6tables -t nat -D POSTROUTING -s 42::/16 -o ${ext-if} -j MASQUERADE
- '';
+ ${pkgs.iptables}/bin/iptables -D FORWARD -i wiregrill -o retiolum -j ACCEPT
+ ${pkgs.iptables}/bin/iptables -D FORWARD -i retiolum -o wiregrill -j ACCEPT
+
+ ${pkgs.iptables}/bin/ip6tables -t nat -D PREROUTING -s 42:1::/32 -j ACCEPT
+ ${pkgs.iptables}/bin/ip6tables -t nat -D POSTROUTING -s 42:1::/32 ! -d 42:1::/48 -j MASQUERADE
+ ${pkgs.iptables}/bin/ip6tables -D FORWARD -i wiregrill -o retiolum -j ACCEPT
+ ${pkgs.iptables}/bin/ip6tables -D FORWARD -i retiolum -o wiregrill -j ACCEPT
+ '' ;
ips =
(optional (!isNull self.ip4) self.ip4.addr) ++
(optional (!isNull self.ip6) self.ip6.addr);