ShatteredMINT/NixosConfig
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

EXPERIMENT: wireguard config

Browse Source
This commit is contained in:
ShatteredMINT
2026-04-02 09:49:57 +02:00
parent 57d07bae2c
commit 86b927b894
3 changed files with 69 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
flake.nix
+2
View File
@@ -54,6 +54,8 @@
./software/default-graphical.nix
./users/shatteredmint.nix
./network-shares.nix
./software/wireguard-client.nix 10
];
};
nix-nas = lib.nixosSystem {
software/wireguard-client.nix
+29
View File
@@ -0,0 +1,29 @@
# reference: https://www.procustodibus.com/blog/2022/06/multi-hop-wireguard/#site-gateway-as-a-spoke
# this configuration is for a device on the home network
# it exposes the entire home network to outside peers
{ip, config, pkgs, ...}@inputs: {
networking = {
firewall.allowedUDPPorts = [56878];
wireguard = {
enable = true;
interfaces.wg0 = {
ips = [ ("192.168.87." ++ ip ++ "/32")];
listenPort = 56878;
privateKeyFile = "/root/wg.keys";
peers = [
{
name = "hub";
publicKey = "XEaJXQW+7llbreoK161NkMhFxlctL1UK8nFiY/GtuC0=";
allowedIPs = [ "192.168.178.0/24" "192.168.87.127/32" "192.168.87.128/25"];
endpoint = "173.249.36.74:56878";
persistentKeepalive = 20;
}
];
};
};
};
}
software/wireguard-gw-site.nix
+38
View File
@@ -0,0 +1,38 @@
# reference: https://www.procustodibus.com/blog/2022/06/multi-hop-wireguard/#site-gateway-as-a-spoke
# this configuration is for a device on the home network
# it exposes the entire home network to outside peers
{config, pkgs, ...}@inputs: {
networking = {
firewall.allowedUDPPorts = [56878];
wireguard = {
enable = true;
interfaces.wg0 = {
ips = [ "192.168.87.250/32"];
listenPort = 56878;
privateKeyFile = "/root/wg.keys";
peers = [
{
name = "hub";
publicKey = "XEaJXQW+7llbreoK161NkMhFxlctL1UK8nFiY/GtuC0=";
allowedIPs = [ "192.168.87.0/25"];
endpoint = "173.249.36.74:56878";
persistentKeepalive = 20;
}
];
postSetup = ''
${pkgs.iptables}/bin/iptables -t mangle -A PREROUTING -i wg0 -j MARK --set-mark 0x30
${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING ! -o wg0 -m mark --mark 0x30 -j MASQUERADE
'';
postShutdown = ''
${pkgs.iptables}/bin/iptables -t mangle -D PREROUTING -i wg0 -j MARK --set-mark 0x30
${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING ! -o wg0 -m mark --mark 0x30 -j MASQUERADE
'';
};
};
};
}