hosts/losurdo/networking/wireguard/extranet.nix

   1 { pkgs, lib, config, hosts, hostName, ... }:
   2 let
   3   wg = "wg-extra";
   4   listenPort = 16843;
   5 in
   6 {
   7 networking.nftables.ruleset = ''
   8   # Allow peers to initiate connection for ${wg}
   9   add rule inet filter net2fw udp dport ${toString listenPort} counter accept comment "${wg}"
  10
  11   # foward
  12   add chain inet filter fwd-extra
  13   add rule  inet filter fwd-extra counter accept
  14   add rule  inet filter forward iifname "${wg}" jump fwd-extra
  15
  16   # input
  17   add chain inet filter extra2fw
  18   add rule  inet filter extra2fw counter accept
  19   add rule  inet filter input iifname "${wg}" jump extra2fw
  20   add rule  inet filter input iifname "${wg}" log level warn prefix "extra2fw: " counter drop
  21
  22   # output
  23   add chain inet filter fw2extra
  24   add rule  inet filter fw2extra counter accept
  25   add rule  inet filter output oifname "${wg}" jump fw2extra
  26   add rule  inet filter output oifname "${wg}" log level warn prefix "fw2extra: " counter drop
  27 '';
  28 #boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
  29 networking.wireguard.interfaces."${wg}" = {
  30   # publicKey: 1Iyq96rPHfyrt4B31NqKLgWzlglkMAWjA41aF279gjM=
  31   privateKeyFile = "/root/secrets/wireguard/${wg}/privateKey";
  32   ips = [ "192.168.43.1/32" ];
  33   inherit listenPort;
  34   socketNamespace = null;
  35   /*
  36   interfaceNamespace = "extra";
  37   preSetup = ''
  38     ${pkgs.iproute}/bin/ip netns add extra
  39   '';
  40   */
  41   peers = [
  42     { # julm-laptop
  43       publicKey = "Ul1+GINJ/eXy7MhUQLB6wXboLUfKW32nwHd/IAGtwSk=";
  44       allowedIPs = [ "192.168.43.2/32" ];
  45     }
  46     { # julm-mobile
  47       publicKey = "7hdI8aInfxFG0Ua1jHMDmx1RezI1q1PObFx6Kp2g5iI=";
  48       allowedIPs = [ "192.168.43.3/32" ];
  49     }
  50   ];
  51 };
  52 }