{ pkgs, lib, config, hosts, hostName, credentials, ... }: let wg = "wg-extra"; listenPort = 16843; in { networking.nftables.ruleset = '' # Allow peers to initiate connection for ${wg} add rule inet filter net2fw udp dport ${toString listenPort} counter accept comment "${wg}" # forward add chain inet filter fwd-extra add rule inet filter fwd-extra counter accept add rule inet filter forward iifname "${wg}" jump fwd-extra # input add chain inet filter extra2fw add rule inet filter extra2fw counter accept add rule inet filter input iifname "${wg}" jump extra2fw add rule inet filter input iifname "${wg}" log level warn prefix "extra2fw: " counter drop # output add chain inet filter fw2extra add rule inet filter fw2extra counter accept add rule inet filter output oifname "${wg}" jump fw2extra add rule inet filter output oifname "${wg}" log level warn prefix "fw2extra: " counter drop ''; #boot.kernel.sysctl."net.ipv4.ip_forward" = 1; systemd.services."wireguard-${wg}".serviceConfig.LoadCredentialEncrypted = "privateKey:${credentials}/wireguard/${wg}/privateKey.secret"; networking.wireguard.interfaces."${wg}" = { # publicKey: 1Iyq96rPHfyrt4B31NqKLgWzlglkMAWjA41aF279gjM= privateKeyFile = "$CREDENTIALS_DIRECTORY/privateKey"; ips = [ "192.168.43.1/32" ]; inherit listenPort; socketNamespace = null; /* interfaceNamespace = "extra"; preSetup = '' ${pkgs.iproute}/bin/ip netns add extra ''; */ peers = [ { # julm-laptop publicKey = "Ul1+GINJ/eXy7MhUQLB6wXboLUfKW32nwHd/IAGtwSk="; allowedIPs = [ "192.168.43.2/32" ]; } { # julm-mobile publicKey = "7hdI8aInfxFG0Ua1jHMDmx1RezI1q1PObFx6Kp2g5iI="; allowedIPs = [ "192.168.43.3/32" ]; } ]; }; }