ParkerTenBroeck/dotfiles
1
0
Fork 0
mirror of https://github.com/ParkerTenBroeck/dotfiles.git synced 2026-06-06 21:00:35 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

organized, fixed wireguard config

Browse source
This commit is contained in:
Parker TenBroeck 2026-05-23 11:13:59 -04:00
parent 1be91dfd0c
commit 079b1eb5d6
12 changed files with 139 additions and 70 deletions
Download patch file Download diff file Expand all files Collapse all files

56
modules/wireguard-server.nix Normal file
View file

@ -0,0 +1,56 @@
{ config, pkgs, ... }:
let
wg-key-pub-home = builtins.readFile ../secrets/wireguard/home_pub;
in
{
age.secrets.wg-server-priv.file = ../secrets/wireguard/server_priv.age;
age.secrets.wg-home-psk.file = ../secrets/wireguard/home_psk.age;
networking.wireguard.enable = true;
# enable NAT
networking.nat = {
enable = true;
enableIPv6 = false;
externalInterface = "eno1";
internalInterfaces = [ "wg0" ];
};
networking.wireguard.interfaces.wg0 = {
ips = [ "10.6.0.1/24" ];
listenPort = 51820;
privateKeyFile = config.age.secrets.wg-server-priv.path;
# This allows the wireguard server to route your traffic to the internet and hence be like a VPN
# For this to work you have to set the dnsserver IP of your router (or dnsserver of choice) in your clients
postSetup = ''
${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.6.0.0/24 -o eno1 -j MASQUERADE
'';
# This undoes the above command
postShutdown = ''
${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.6.0.0/24 -o eno1 -j MASQUERADE
'';
peers = [
{
name = "Home";
publicKey = wg-key-pub-home;
presharedKeyFile = config.age.secrets.wg-home-psk.path;
allowedIPs = [ "10.6.0.2/32" ];
}
];
};
networking.firewall = {
allowedUDPPorts = [ 51820 ];
};
# Enable forwarding
boot.kernel.sysctl = {
"net.ipv4.ip_forward" = 1;
"net.ipv6.conf.all.forwarding" = 1;
};
}