66 lines
1.7 KiB
Nix
66 lines
1.7 KiB
Nix
|
{pkgs, config, ...}: {
|
||
|
|
||
|
age.secrets.mullvad.file = ../secrets/mullvad.age;
|
||
|
|
||
|
environment.shellAliases = {
|
||
|
mullvad-up = "systemctl start wg-quick-wg0.service";
|
||
|
mullvad-down = "systemctl stop wg-quick-wg0.service";
|
||
|
};
|
||
|
|
||
|
networking.wg-quick.interfaces = let
|
||
|
server_ip = "146.70.198.194";
|
||
|
in {
|
||
|
wg0 = {
|
||
|
autostart = false;
|
||
|
|
||
|
# IP address of this machine in the *tunnel network*
|
||
|
address = [
|
||
|
"10.70.139.192/32"
|
||
|
"fc00:bbbb:bbbb:bb01::7:8bbf/128"
|
||
|
];
|
||
|
|
||
|
# To match firewall allowedUDPPorts (without this wg
|
||
|
# uses random port numbers).
|
||
|
listenPort = 51820;
|
||
|
|
||
|
# Path to the private key file.
|
||
|
privateKeyFile = config.age.secrets.mullvad.path;
|
||
|
|
||
|
peers = [{
|
||
|
publicKey = "57Zu2qPzRScZWsoC2NhXgz0FiC0HiKkbEa559sbxB3k=";
|
||
|
allowedIPs = [ "0.0.0.0/0" ];
|
||
|
endpoint = "${server_ip}:51820";
|
||
|
persistentKeepalive = 25;
|
||
|
}];
|
||
|
|
||
|
postUp = ''
|
||
|
wg set wg0 fwmark 51820
|
||
|
|
||
|
${pkgs.iptables}/bin/iptables -I OUTPUT \
|
||
|
! -o wg0 \
|
||
|
-m mark ! --mark $(wg show wg0 fwmark) \
|
||
|
-m addrtype ! --dst-type LOCAL \
|
||
|
-j REJECT
|
||
|
${pkgs.iptables}/bin/ip6tables -I OUTPUT \
|
||
|
! -o wg0 \
|
||
|
-m mark ! --mark $(wg show wg0 fwmark) \
|
||
|
-m addrtype ! --dst-type LOCAL \
|
||
|
-j REJECT
|
||
|
'';
|
||
|
|
||
|
preDown = ''
|
||
|
${pkgs.iptables}/bin/iptables -D OUTPUT \
|
||
|
! -o wg0 \
|
||
|
-m mark ! --mark $(wg show wg0 fwmark) \
|
||
|
-m addrtype ! --dst-type LOCAL \
|
||
|
-j REJECT
|
||
|
${pkgs.iptables}/bin/ip6tables -D OUTPUT \
|
||
|
! -o wg0 -m mark \
|
||
|
! --mark $(wg show wg0 fwmark) \
|
||
|
-m addrtype ! --dst-type LOCAL \
|
||
|
-j REJECT
|
||
|
'';
|
||
|
};
|
||
|
};
|
||
|
}
|