nix-config/modules/mullvad.nix

71 lines
1.8 KiB
Nix
Raw Normal View History

{
pkgs,
config,
...
}: {
2024-03-23 19:54:24 +00:00
age.secrets.mullvad.file = ../secrets/mullvad.age;
environment.shellAliases = {
mullvad-up = "systemctl start wg-quick-wg0.service";
mullvad-down = "systemctl stop wg-quick-wg0.service";
};
networking.wg-quick.interfaces = let
server_ip = "146.70.198.194";
in {
wg0 = {
autostart = false;
# IP address of this machine in the *tunnel network*
address = [
"10.70.139.192/32"
"fc00:bbbb:bbbb:bb01::7:8bbf/128"
];
# To match firewall allowedUDPPorts (without this wg
# uses random port numbers).
listenPort = 51820;
# Path to the private key file.
privateKeyFile = config.age.secrets.mullvad.path;
peers = [
{
publicKey = "57Zu2qPzRScZWsoC2NhXgz0FiC0HiKkbEa559sbxB3k=";
allowedIPs = ["0.0.0.0/0"];
endpoint = "${server_ip}:51820";
persistentKeepalive = 25;
}
];
2024-03-23 19:54:24 +00:00
postUp = ''
wg set wg0 fwmark 51820
${pkgs.iptables}/bin/iptables -I OUTPUT \
! -o wg0 \
-m mark ! --mark $(wg show wg0 fwmark) \
-m addrtype ! --dst-type LOCAL \
-j REJECT
${pkgs.iptables}/bin/ip6tables -I OUTPUT \
! -o wg0 \
-m mark ! --mark $(wg show wg0 fwmark) \
-m addrtype ! --dst-type LOCAL \
-j REJECT
'';
preDown = ''
${pkgs.iptables}/bin/iptables -D OUTPUT \
! -o wg0 \
-m mark ! --mark $(wg show wg0 fwmark) \
-m addrtype ! --dst-type LOCAL \
-j REJECT
${pkgs.iptables}/bin/ip6tables -D OUTPUT \
! -o wg0 -m mark \
! --mark $(wg show wg0 fwmark) \
-m addrtype ! --dst-type LOCAL \
-j REJECT
'';
};
};
}