Mic92
/
stockholm
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

ma wiregrill: also masquerade ipv6

This commit is contained in:
makefu 2023-03-22 23:18:23 +01:00
parent caa8f83e79
commit 48c3746cf0
No known key found for this signature in database
GPG Key ID: 36F7711F3FC0F225
1 changed files with 17 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
makefu/2configs/wireguard/wiregrill.nix
View File

@ -13,16 +13,32 @@ in mkIf (hasAttr "wiregrill" config.krebs.build.host.nets) {
boot.kernel.sysctl = mkIf isRouter {
"net.ipv6.conf.all.forwarding" = 1;
"net.ipv4.conf.all.forwarding" = 1;
};
networking.nat = {
enable = true;
externalInterface = ext-if;
internalInterfaces = [ "wiregrill" ];
};
networking.firewall = {
allowedUDPPorts = [ self.wireguard.port ];
extraCommands = ''
iptables -A FORWARD -i wiregrill -o wiregrill -j ACCEPT
${pkgs.iptables}/bin/iptables -A FORWARD -i wiregrill -o wiregrill -j ACCEPT
'';
};
networking.wireguard.interfaces.wiregrill = {
postSetup = ''
${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.220.245.0/24 -o ${ext-if} -j MASQUERADE
${pkgs.iptables}/bin/ip6tables -t nat -A POSTROUTING -s 42::/16 -o ${ext-if} -j MASQUERADE
'';
# This undoes the above command
postShutdown = ''
${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.244.245.0/24 -o ${ext-if} -j MASQUERADE
${pkgs.iptables}/bin/ip6tables -t nat -D POSTROUTING -s 42::/16 -o ${ext-if} -j MASQUERADE
'';
ips =
(optional (!isNull self.ip4) self.ip4.addr) ++
(optional (!isNull self.ip6) self.ip6.addr);