diff options
| author | makefu <github@syntax-fehler.de> | 2023-03-22 23:18:23 +0100 |
|---|---|---|
| committer | makefu <github@syntax-fehler.de> | 2023-03-22 23:18:23 +0100 |
| commit | 48c3746cf09aedf888692856e33f9a803ae37829 (patch) | |
| tree | 7f978434a9ee575c9ac387c46e2586278416578a /makefu/2configs/wireguard | |
| parent | caa8f83e79f7373bf234874b8614117c3f7a0710 (diff) | |
ma wiregrill: also masquerade ipv6
Diffstat (limited to 'makefu/2configs/wireguard')
| -rw-r--r-- | makefu/2configs/wireguard/wiregrill.nix | 18 |
1 files changed, 17 insertions, 1 deletions
diff --git a/makefu/2configs/wireguard/wiregrill.nix b/makefu/2configs/wireguard/wiregrill.nix index 082090755..dbe3a91c1 100644 --- a/makefu/2configs/wireguard/wiregrill.nix +++ b/makefu/2configs/wireguard/wiregrill.nix @@ -13,16 +13,32 @@ in mkIf (hasAttr "wiregrill" config.krebs.build.host.nets) { boot.kernel.sysctl = mkIf isRouter { "net.ipv6.conf.all.forwarding" = 1; + "net.ipv4.conf.all.forwarding" = 1; + }; + networking.nat = { + enable = true; + externalInterface = ext-if; + internalInterfaces = [ "wiregrill" ]; }; networking.firewall = { allowedUDPPorts = [ self.wireguard.port ]; extraCommands = '' - iptables -A FORWARD -i wiregrill -o wiregrill -j ACCEPT + ${pkgs.iptables}/bin/iptables -A FORWARD -i wiregrill -o wiregrill -j ACCEPT ''; }; networking.wireguard.interfaces.wiregrill = { + postSetup = '' + ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.220.245.0/24 -o ${ext-if} -j MASQUERADE + ${pkgs.iptables}/bin/ip6tables -t nat -A POSTROUTING -s 42::/16 -o ${ext-if} -j MASQUERADE + ''; + + # This undoes the above command + postShutdown = '' + ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.244.245.0/24 -o ${ext-if} -j MASQUERADE + ${pkgs.iptables}/bin/ip6tables -t nat -D POSTROUTING -s 42::/16 -o ${ext-if} -j MASQUERADE + ''; ips = (optional (!isNull self.ip4) self.ip4.addr) ++ (optional (!isNull self.ip6) self.ip6.addr); |