Mic92/stockholm
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

ma wiregrill: allow masquerading between wiregrill/retiolum

Browse Source
This commit is contained in:
makefu 2023-03-23 01:10:21 +01:00
parent 1d1eb043d1
commit 55b00f7139
No known key found for this signature in database
GPG Key ID: 36F7711F3FC0F225
1 changed files with 34 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

43
makefu/2configs/wireguard/wiregrill.nix
View File

@ -15,30 +15,55 @@ in mkIf (hasAttr "wiregrill" config.krebs.build.host.nets) {
"net.ipv6.conf.all.forwarding" = 1; "net.ipv6.conf.all.forwarding" = 1;
"net.ipv4.conf.all.forwarding" = 1; "net.ipv4.conf.all.forwarding" = 1;
}; };
networking.nat = { networking.nat = mkIf isRouter {
enable = true; enable = true;
enableIPv6 = true;
externalInterface = ext-if; externalInterface = ext-if;
internalInterfaces = [ "wiregrill" ]; internalInterfaces = [ "wiregrill" ];
}; };
networking.firewall = { networking.firewall = {
allowedUDPPorts = [ self.wireguard.port ]; allowedUDPPorts = [ self.wireguard.port ];
extraCommands = '' interfaces.wiregrill = mkIf isRouter {
${pkgs.iptables}/bin/iptables -A FORWARD -i wiregrill -o wiregrill -j ACCEPT allowedUDPPorts = [ 53 ];
allowedTCPPorts = [ 53 ];
};
};
services.dnsmasq = mkIf isRouter {
enable = true;
resolveLocalQueries = false;
extraConfig = /* dnsmasq */ ''
bind-interfaces
interface=retiolum,wiregrill
''; '';
servers = [ "1.1.1.1" ];
}; };
networking.wireguard.interfaces.wiregrill = { networking.wireguard.interfaces.wiregrill = {
postSetup = '' postSetup = optionalString isRouter ''
${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.220.245.0/24 -o ${ext-if} -j MASQUERADE ${pkgs.iptables}/bin/iptables -t nat -A PREROUTING -s 10.244.245.0/24 -j ACCEPT
${pkgs.iptables}/bin/ip6tables -t nat -A POSTROUTING -s 42::/16 -o ${ext-if} -j MASQUERADE ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.244.245.0/24 ! -d 10.244.245.0/24 -j MASQUERADE
${pkgs.iptables}/bin/iptables -A FORWARD -i wiregrill -o retiolum -j ACCEPT
${pkgs.iptables}/bin/iptables -A FORWARD -i retiolum -o wiregrill -j ACCEPT
${pkgs.iptables}/bin/ip6tables -t nat -A PREROUTING -s 42:1::/32 -j ACCEPT
${pkgs.iptables}/bin/ip6tables -t nat -A POSTROUTING -s 42:1::/32 ! -d 42:1::/48 -j MASQUERADE
${pkgs.iptables}/bin/ip6tables -A FORWARD -i wiregrill -o retiolum -j ACCEPT
${pkgs.iptables}/bin/ip6tables -A FORWARD -i retiolum -o wiregrill -j ACCEPT
''; '';
# This undoes the above command # This undoes the above command
postShutdown = '' postShutdown = optionalString isRouter ''
${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.244.245.0/24 -o ${ext-if} -j MASQUERADE ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.244.245.0/24 -o ${ext-if} -j MASQUERADE
${pkgs.iptables}/bin/ip6tables -t nat -D POSTROUTING -s 42::/16 -o ${ext-if} -j MASQUERADE ${pkgs.iptables}/bin/iptables -D FORWARD -i wiregrill -o retiolum -j ACCEPT
''; ${pkgs.iptables}/bin/iptables -D FORWARD -i retiolum -o wiregrill -j ACCEPT
${pkgs.iptables}/bin/ip6tables -t nat -D PREROUTING -s 42:1::/32 -j ACCEPT
${pkgs.iptables}/bin/ip6tables -t nat -D POSTROUTING -s 42:1::/32 ! -d 42:1::/48 -j MASQUERADE
${pkgs.iptables}/bin/ip6tables -D FORWARD -i wiregrill -o retiolum -j ACCEPT
${pkgs.iptables}/bin/ip6tables -D FORWARD -i retiolum -o wiregrill -j ACCEPT
'' ;
ips = ips =
(optional (!isNull self.ip4) self.ip4.addr) ++ (optional (!isNull self.ip4) self.ip4.addr) ++
(optional (!isNull self.ip6) self.ip6.addr); (optional (!isNull self.ip6) self.ip6.addr);