Wireguard

1 files changed, 32 insertions, 0 deletions

diff --git a/hostnix/elmo/wireguard.nix b/hostnix/elmo/wireguard.nix
new file mode 100644
index 0000000..7d56062
--- /dev/null
+++ b/hostnix/elmo/wireguard.nix
@@ -0,0 +1,32 @@
+{ pkgs, ... }:
+
+{
+  networking.nat = {
+    enable = true;
+    enableIPv6 = true;
+    externalInterface = "enp3s0f0";
+    internalInterfaces = [ "wg0" ];
+  };
+
+  networking.wg-quick.interfaces = {
+    wg0 = {
+      address = [ "172.28.92.1/24" "fd61:754f:ebd3:1c5c::1/64" ];
+      listenPort = 51820;
+      privateKeyFile = "/var/secrets/wg0.key";
+      postUp = ''
+        ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -o enp3s0f0 -j MASQUERADE
+        ${pkgs.iptables}/bin/ip6tables -t nat -A POSTROUTING -o enp3s0f0 -j MASQUERADE
+      '';
+      preDown = ''
+        ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -o enp3s0f0 -j MASQUERADE
+        ${pkgs.iptables}/bin/ip6tables -t nat -D POSTROUTING -o enp3s0f0 -j MASQUERADE
+      '';
+      peers = [ {
+        publicKey = "ZfJaZgG8e2neWJBWcN3cZsDd740Zq+sW/2pmBqSgbRI=";
+        allowedIPs = [ "172.28.92.2" "fd61:754f:ebd3:1c5c::2" ];
+      } ];
+    };
+  };
+
+  networking.firewall.allowedUDPPorts = [ 51820 ];
+}