summaryrefslogtreecommitdiffstats
path: root/makefu/2configs/wireguard/server.nix
blob: bb3198178db3a7757d881d606d338240ce65a3d7 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
{ config,pkgs, ... }:
let
  ext-if = config.makefu.server.primary-itf;
in { # wireguard server

  # opkg install wireguard luci-proto-wireguard

  # boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
  # conf.all.proxy_arp =1
  networking.firewall = {
    allowedUDPPorts = [ 51820 ];
  };
  networking.nat = {
    enable = true;
    #externalIP = "144.76.26.247";
    #internalIPs = [ "10.244.0.0/24" ];
    externalInterface = ext-if;
    internalInterfaces = [ "wg0" ];
  };
  networking.wireguard.interfaces.wg0 = {
    ips = [ "10.244.0.1/24" ];
    listenPort = 51820;
    privateKeyFile = (toString <secrets>) + "/wireguard.key";
    # allowedIPsAsRoutes = true;
    postSetup = ''
        ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.244.0.0/24 -o ${ext-if} -j MASQUERADE
    '';

      # This undoes the above command
    postShutdown = ''
        ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.244.0.0/24 -o ${ext-if} -j MASQUERADE
    '';
    peers = [
      {
        # x
        allowedIPs = [ "10.244.0.2/32" ];
        publicKey = "fe5smvKVy5GAn7EV4w4tav6mqIAKhGWQotm7dRuRt1g=";
      }
      {
        # vbob
        allowedIPs = [ "10.244.0.3/32" ];
        publicKey = "Lju7EsCu1OWXhkhdNR7c/uiN60nr0TUPHQ+s8ULPQTw=";
      }
      {
        # x-test
        allowedIPs = [ "10.244.0.4/32" ];
        publicKey = "vZ/AJpfDLJyU3DzvYeW70l4FNziVgSTumA89wGHG7XY=";
      }
      {
        # work-router
        persistentKeepalive = 25;
        allowedIPs = [ "10.244.0.5/32" ];
        publicKey = "QJMwwYu/92koCASbHnR/vqe/rN00EV6/o7BGwLockDw=";
      }
      {
        # workr
        persistentKeepalive = 25;
        allowedIPs = [ "10.244.0.6/32" ];
        publicKey = "OFhCF56BrV9tjqW1sxqXEKH/GdqamUT1SqZYSADl5GA=";
      }
      {
        # mobile
        allowedIPs = [ "10.244.0.7/32" ];
        publicKey = "Y6fOW2QDt0SsHT7hSVzzJYQVB3JI/txO4/FDB54Z52A=";
      }
    ];
  };
  # TODO: this issue is related to the router which connects to the host but is
  # unable to re-connect once restarted
}