diff --git a/flake.nix b/flake.nix
index 95a5bd4..87b5e3a 100644
--- a/flake.nix
+++ b/flake.nix
@@ -54,6 +54,8 @@
           ./software/default-graphical.nix
           ./users/shatteredmint.nix
           ./network-shares.nix
+
+          ./software/wireguard-client.nix 10
         ];
       };
       nix-nas = lib.nixosSystem {
diff --git a/software/wireguard-client.nix b/software/wireguard-client.nix
new file mode 100644
index 0000000..d92329c
--- /dev/null
+++ b/software/wireguard-client.nix
@@ -0,0 +1,29 @@
+# reference: https://www.procustodibus.com/blog/2022/06/multi-hop-wireguard/#site-gateway-as-a-spoke
+# this configuration is for a device on the home network
+# it exposes the entire home network to outside peers
+
+{ip, config, pkgs, ...}@inputs: {
+    networking = {
+        firewall.allowedUDPPorts = [56878];
+        wireguard = {
+            enable = true;
+            interfaces.wg0 = {
+                ips = [ ("192.168.87." ++ ip ++ "/32")];
+                listenPort = 56878;
+                privateKeyFile = "/root/wg.keys";
+
+                peers = [
+                    {
+                        name = "hub";
+                        publicKey = "XEaJXQW+7llbreoK161NkMhFxlctL1UK8nFiY/GtuC0=";
+                        allowedIPs = [ "192.168.178.0/24" "192.168.87.127/32" "192.168.87.128/25"];
+                        endpoint = "173.249.36.74:56878";
+                        persistentKeepalive = 20;
+                    }
+                ];
+            };
+        };
+    };
+}
+
+
diff --git a/software/wireguard-gw-site.nix b/software/wireguard-gw-site.nix
new file mode 100644
index 0000000..08c36f1
--- /dev/null
+++ b/software/wireguard-gw-site.nix
@@ -0,0 +1,38 @@
+# reference: https://www.procustodibus.com/blog/2022/06/multi-hop-wireguard/#site-gateway-as-a-spoke
+# this configuration is for a device on the home network
+# it exposes the entire home network to outside peers
+
+{config, pkgs, ...}@inputs: {
+    networking = {
+        firewall.allowedUDPPorts = [56878];
+        wireguard = {
+            enable = true;
+            interfaces.wg0 = {
+                ips = [ "192.168.87.250/32"];
+                listenPort = 56878;
+                privateKeyFile = "/root/wg.keys";
+
+                peers = [
+                    {
+                        name = "hub";
+                        publicKey = "XEaJXQW+7llbreoK161NkMhFxlctL1UK8nFiY/GtuC0=";
+                        allowedIPs = [ "192.168.87.0/25"];
+                        endpoint = "173.249.36.74:56878";
+                        persistentKeepalive = 20;
+                    }
+                ];
+
+                postSetup = ''
+                    ${pkgs.iptables}/bin/iptables -t mangle -A PREROUTING -i wg0 -j MARK --set-mark 0x30
+                    ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING ! -o wg0 -m mark --mark 0x30 -j MASQUERADE
+                '';
+                postShutdown = ''
+                    ${pkgs.iptables}/bin/iptables -t mangle -D PREROUTING -i wg0 -j MARK --set-mark 0x30
+                    ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING ! -o wg0 -m mark --mark 0x30 -j MASQUERADE
+                '';
+            };
+        };
+    };
+}
+
+