From 48c3746cf09aedf888692856e33f9a803ae37829 Mon Sep 17 00:00:00 2001 From: makefu Date: Wed, 22 Mar 2023 23:18:23 +0100 Subject: ma wiregrill: also masquerade ipv6 --- makefu/2configs/wireguard/wiregrill.nix | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) (limited to 'makefu/2configs/wireguard') diff --git a/makefu/2configs/wireguard/wiregrill.nix b/makefu/2configs/wireguard/wiregrill.nix index 082090755..dbe3a91c1 100644 --- a/makefu/2configs/wireguard/wiregrill.nix +++ b/makefu/2configs/wireguard/wiregrill.nix @@ -13,16 +13,32 @@ in mkIf (hasAttr "wiregrill" config.krebs.build.host.nets) { boot.kernel.sysctl = mkIf isRouter { "net.ipv6.conf.all.forwarding" = 1; + "net.ipv4.conf.all.forwarding" = 1; + }; + networking.nat = { + enable = true; + externalInterface = ext-if; + internalInterfaces = [ "wiregrill" ]; }; networking.firewall = { allowedUDPPorts = [ self.wireguard.port ]; extraCommands = '' - iptables -A FORWARD -i wiregrill -o wiregrill -j ACCEPT + ${pkgs.iptables}/bin/iptables -A FORWARD -i wiregrill -o wiregrill -j ACCEPT ''; }; networking.wireguard.interfaces.wiregrill = { + postSetup = '' + ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.220.245.0/24 -o ${ext-if} -j MASQUERADE + ${pkgs.iptables}/bin/ip6tables -t nat -A POSTROUTING -s 42::/16 -o ${ext-if} -j MASQUERADE + ''; + + # This undoes the above command + postShutdown = '' + ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.244.245.0/24 -o ${ext-if} -j MASQUERADE + ${pkgs.iptables}/bin/ip6tables -t nat -D POSTROUTING -s 42::/16 -o ${ext-if} -j MASQUERADE + ''; ips = (optional (!isNull self.ip4) self.ip4.addr) ++ (optional (!isNull self.ip6) self.ip6.addr); -- cgit v1.2.3 From 55b00f7139d07469d6be3037d2443850b6d7496c Mon Sep 17 00:00:00 2001 From: makefu Date: Thu, 23 Mar 2023 01:10:21 +0100 Subject: ma wiregrill: allow masquerading between wiregrill/retiolum --- makefu/2configs/wireguard/wiregrill.nix | 43 ++++++++++++++++++++++++++------- 1 file changed, 34 insertions(+), 9 deletions(-) (limited to 'makefu/2configs/wireguard') diff --git a/makefu/2configs/wireguard/wiregrill.nix b/makefu/2configs/wireguard/wiregrill.nix index dbe3a91c1..070f01e10 100644 --- a/makefu/2configs/wireguard/wiregrill.nix +++ b/makefu/2configs/wireguard/wiregrill.nix @@ -15,30 +15,55 @@ in mkIf (hasAttr "wiregrill" config.krebs.build.host.nets) { "net.ipv6.conf.all.forwarding" = 1; "net.ipv4.conf.all.forwarding" = 1; }; - networking.nat = { + networking.nat = mkIf isRouter { enable = true; + enableIPv6 = true; externalInterface = ext-if; internalInterfaces = [ "wiregrill" ]; }; networking.firewall = { allowedUDPPorts = [ self.wireguard.port ]; - extraCommands = '' - ${pkgs.iptables}/bin/iptables -A FORWARD -i wiregrill -o wiregrill -j ACCEPT + interfaces.wiregrill = mkIf isRouter { + allowedUDPPorts = [ 53 ]; + allowedTCPPorts = [ 53 ]; + }; + }; + + services.dnsmasq = mkIf isRouter { + enable = true; + resolveLocalQueries = false; + extraConfig = /* dnsmasq */ '' + bind-interfaces + interface=retiolum,wiregrill ''; + servers = [ "1.1.1.1" ]; }; networking.wireguard.interfaces.wiregrill = { - postSetup = '' - ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.220.245.0/24 -o ${ext-if} -j MASQUERADE - ${pkgs.iptables}/bin/ip6tables -t nat -A POSTROUTING -s 42::/16 -o ${ext-if} -j MASQUERADE + postSetup = optionalString isRouter '' + ${pkgs.iptables}/bin/iptables -t nat -A PREROUTING -s 10.244.245.0/24 -j ACCEPT + ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.244.245.0/24 ! -d 10.244.245.0/24 -j MASQUERADE + ${pkgs.iptables}/bin/iptables -A FORWARD -i wiregrill -o retiolum -j ACCEPT + ${pkgs.iptables}/bin/iptables -A FORWARD -i retiolum -o wiregrill -j ACCEPT + + ${pkgs.iptables}/bin/ip6tables -t nat -A PREROUTING -s 42:1::/32 -j ACCEPT + ${pkgs.iptables}/bin/ip6tables -t nat -A POSTROUTING -s 42:1::/32 ! -d 42:1::/48 -j MASQUERADE + ${pkgs.iptables}/bin/ip6tables -A FORWARD -i wiregrill -o retiolum -j ACCEPT + ${pkgs.iptables}/bin/ip6tables -A FORWARD -i retiolum -o wiregrill -j ACCEPT ''; # This undoes the above command - postShutdown = '' + postShutdown = optionalString isRouter '' ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.244.245.0/24 -o ${ext-if} -j MASQUERADE - ${pkgs.iptables}/bin/ip6tables -t nat -D POSTROUTING -s 42::/16 -o ${ext-if} -j MASQUERADE - ''; + ${pkgs.iptables}/bin/iptables -D FORWARD -i wiregrill -o retiolum -j ACCEPT + ${pkgs.iptables}/bin/iptables -D FORWARD -i retiolum -o wiregrill -j ACCEPT + + ${pkgs.iptables}/bin/ip6tables -t nat -D PREROUTING -s 42:1::/32 -j ACCEPT + ${pkgs.iptables}/bin/ip6tables -t nat -D POSTROUTING -s 42:1::/32 ! -d 42:1::/48 -j MASQUERADE + ${pkgs.iptables}/bin/ip6tables -D FORWARD -i wiregrill -o retiolum -j ACCEPT + ${pkgs.iptables}/bin/ip6tables -D FORWARD -i retiolum -o wiregrill -j ACCEPT + '' ; ips = (optional (!isNull self.ip4) self.ip4.addr) ++ (optional (!isNull self.ip6) self.ip6.addr); -- cgit v1.2.3 From c0c9a93295521f5bc63a113ece613a28e32f5ddb Mon Sep 17 00:00:00 2001 From: makefu Date: Sat, 3 Jun 2023 15:37:11 +0200 Subject: ma wireguard: ensure correct routing on server --- makefu/2configs/wireguard/server.nix | 1 - makefu/2configs/wireguard/wiregrill.nix | 70 +++++++++++++++++++++------------ 2 files changed, 44 insertions(+), 27 deletions(-) (limited to 'makefu/2configs/wireguard') diff --git a/makefu/2configs/wireguard/server.nix b/makefu/2configs/wireguard/server.nix index bda250702..bb3198178 100644 --- a/makefu/2configs/wireguard/server.nix +++ b/makefu/2configs/wireguard/server.nix @@ -17,7 +17,6 @@ in { # wireguard server externalInterface = ext-if; internalInterfaces = [ "wg0" ]; }; - networking.wireguard.interfaces.wg0 = { ips = [ "10.244.0.1/24" ]; listenPort = 51820; diff --git a/makefu/2configs/wireguard/wiregrill.nix b/makefu/2configs/wireguard/wiregrill.nix index 070f01e10..922dc8c0f 100644 --- a/makefu/2configs/wireguard/wiregrill.nix +++ b/makefu/2configs/wireguard/wiregrill.nix @@ -15,12 +15,12 @@ in mkIf (hasAttr "wiregrill" config.krebs.build.host.nets) { "net.ipv6.conf.all.forwarding" = 1; "net.ipv4.conf.all.forwarding" = 1; }; - networking.nat = mkIf isRouter { - enable = true; - enableIPv6 = true; - externalInterface = ext-if; - internalInterfaces = [ "wiregrill" ]; - }; + #networking.nat = mkIf isRouter { + # enable = true; + # enableIPv6 = true; + # externalInterface = ext-if; + # internalInterfaces = [ "wiregrill" ]; + #}; networking.firewall = { allowedUDPPorts = [ self.wireguard.port ]; @@ -40,30 +40,48 @@ in mkIf (hasAttr "wiregrill" config.krebs.build.host.nets) { servers = [ "1.1.1.1" ]; }; - networking.wireguard.interfaces.wiregrill = { - postSetup = optionalString isRouter '' - ${pkgs.iptables}/bin/iptables -t nat -A PREROUTING -s 10.244.245.0/24 -j ACCEPT - ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.244.245.0/24 ! -d 10.244.245.0/24 -j MASQUERADE - ${pkgs.iptables}/bin/iptables -A FORWARD -i wiregrill -o retiolum -j ACCEPT - ${pkgs.iptables}/bin/iptables -A FORWARD -i retiolum -o wiregrill -j ACCEPT + networking.wireguard.interfaces.wiregrill = let + ipt = "${pkgs.iptables}/bin/iptables"; + ip6 = "${pkgs.iptables}/bin/ip6tables"; + in { + postSetup = '' + ${ipt} -A FORWARD -i wiregrill -o retiolum -j ACCEPT + ${ipt} -A FORWARD -i wiregrill -o wiregrill -j ACCEPT + ${ipt} -A FORWARD -o wiregrill -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT + ${ip6} -A FORWARD -i wiregrill -o retiolum -j ACCEPT + ${ip6} -A FORWARD -i retiolum -o wiregrill -j ACCEPT + ${ip6} -A FORWARD -i wiregrill -o wiregrill -j ACCEPT + ${ip6} -A FORWARD -o wiregrill -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT - ${pkgs.iptables}/bin/ip6tables -t nat -A PREROUTING -s 42:1::/32 -j ACCEPT - ${pkgs.iptables}/bin/ip6tables -t nat -A POSTROUTING -s 42:1::/32 ! -d 42:1::/48 -j MASQUERADE - ${pkgs.iptables}/bin/ip6tables -A FORWARD -i wiregrill -o retiolum -j ACCEPT - ${pkgs.iptables}/bin/ip6tables -A FORWARD -i retiolum -o wiregrill -j ACCEPT - ''; + '' + (optionalString isRouter '' + #${ipt} -t nat -A PREROUTING -s 10.244.245.0/24 -j ACCEPT + #${ipt} -t nat -A POSTROUTING -s 10.244.245.0/24 ! -d 10.244.245.0/24 -j MASQUERADE + + #${ip6} -t nat -A PREROUTING -s 42:1::/32 -j ACCEPT + #${ip6} -t nat -A POSTROUTING -s 42:1::/32 ! -d 42:1::/48 -j MASQUERADE + ''); # This undoes the above command - postShutdown = optionalString isRouter '' - ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.244.245.0/24 -o ${ext-if} -j MASQUERADE - ${pkgs.iptables}/bin/iptables -D FORWARD -i wiregrill -o retiolum -j ACCEPT - ${pkgs.iptables}/bin/iptables -D FORWARD -i retiolum -o wiregrill -j ACCEPT + postShutdown = '' + ${ipt} -D FORWARD -i wiregrill -o retiolum -j ACCEPT + ${ipt} -D FORWARD -i retiolum -o wiregrill -j ACCEPT + ${ipt} -D FORWARD -i wiregrill -o wiregrill -j ACCEPT + ${ipt} -D FORWARD -i wiregrill -o wiregrill -j ACCEPT + ${ipt} -D FORWARD -o wiregrill -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT + + ${ip6} -D FORWARD -i wiregrill -o retiolum -j ACCEPT + ${ip6} -D FORWARD -i retiolum -o wiregrill -j ACCEPT + ${ip6} -D FORWARD -i wiregrill -o wiregrill -j ACCEPT + ${ip6} -D FORWARD -o wiregrill -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT + + '' + (optionalString isRouter '' + + ${ipt} -t nat -D PREROUTING -s 10.244.245.0/24 -j ACCEPT + ${ipt} -t nat -D POSTROUTING -s 10.244.245.0/24 -j MASQUERADE - ${pkgs.iptables}/bin/ip6tables -t nat -D PREROUTING -s 42:1::/32 -j ACCEPT - ${pkgs.iptables}/bin/ip6tables -t nat -D POSTROUTING -s 42:1::/32 ! -d 42:1::/48 -j MASQUERADE - ${pkgs.iptables}/bin/ip6tables -D FORWARD -i wiregrill -o retiolum -j ACCEPT - ${pkgs.iptables}/bin/ip6tables -D FORWARD -i retiolum -o wiregrill -j ACCEPT - '' ; + #${ip6} -t nat -D PREROUTING -s 42:1::/32 -j ACCEPT + #${ip6} -t nat -D POSTROUTING -s 42:1::/32 ! -d 42:1::/48 -j MASQUERADE + '' ); ips = (optional (!isNull self.ip4) self.ip4.addr) ++ (optional (!isNull self.ip6) self.ip6.addr); -- cgit v1.2.3