39 lines
1.4 KiB
Nix
39 lines
1.4 KiB
Nix
# reference: https://www.procustodibus.com/blog/2022/06/multi-hop-wireguard/#site-gateway-as-a-spoke
|
|
# this configuration is for a device on the home network
|
|
# it exposes the entire home network to outside peers
|
|
|
|
{config, pkgs, ...}@inputs: {
|
|
networking = {
|
|
firewall.allowedUDPPorts = [56878];
|
|
wireguard = {
|
|
enable = true;
|
|
interfaces.wg0 = {
|
|
ips = [ "192.168.87.250/32"];
|
|
listenPort = 56878;
|
|
privateKeyFile = "/root/wg.keys";
|
|
|
|
peers = [
|
|
{
|
|
name = "hub";
|
|
publicKey = "XEaJXQW+7llbreoK161NkMhFxlctL1UK8nFiY/GtuC0=";
|
|
allowedIPs = [ "192.168.87.0/25"];
|
|
endpoint = "173.249.36.74:56878";
|
|
persistentKeepalive = 20;
|
|
}
|
|
];
|
|
|
|
postSetup = ''
|
|
${pkgs.iptables}/bin/iptables -t mangle -A PREROUTING -i wg0 -j MARK --set-mark 0x30
|
|
${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING ! -o wg0 -m mark --mark 0x30 -j MASQUERADE
|
|
'';
|
|
postShutdown = ''
|
|
${pkgs.iptables}/bin/iptables -t mangle -D PREROUTING -i wg0 -j MARK --set-mark 0x30
|
|
${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING ! -o wg0 -m mark --mark 0x30 -j MASQUERADE
|
|
'';
|
|
};
|
|
};
|
|
};
|
|
}
|
|
|
|
|