blob: 1e7edbf78e810ef248056783e8a1822b609fda22 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
|
{ config, pkgs, ... }:
let
out-itf = config.makefu.server.primary-itf;
# generate via openvpn --genkey --secret static.key
client-key = (toString <secrets>) + "/openvpn-laptop.key";
# domain = "vpn.euer.krebsco.de";
domain = "gum.krebsco.de";
dev = "tun0";
port = 1194;
tcp-port = 3306;
in {
boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
networking.nat = {
enable = true;
externalInterface = out-itf;
internalInterfaces = [ dev ];
};
networking.firewall.trustedInterfaces = [ dev ];
networking.firewall.allowedUDPPorts = [ port ];
environment.systemPackages = [ pkgs.openvpn ];
services.openvpn.servers.smartphone.config = ''
#user nobody
#group nobody
dev ${dev}
proto udp
ifconfig 10.8.0.1 10.8.0.2
secret ${client-key}
port ${toString port}
cipher AES-256-CBC
comp-lzo
keepalive 10 60
ping-timer-rem
persist-tun
persist-key
'';
environment.etc."openvpn/smartphone-client.ovpn" = {
text = ''
client
dev tun
remote "${domain}"
ifconfig 10.8.0.1 10.8.0.2
port ${toString port}
cipher AES-256-CBC
comp-lzo
keepalive 10 60
resolv-retry infinite
nobind
persist-key
persist-tun
secret [inline]
'';
mode = "700";
};
system.activationScripts.openvpn-addkey = ''
f="/etc/openvpn/smartphone-client.ovpn"
if ! grep -q '<secret>' $f; then
echo "appending secret key"
echo "<secret>" >> $f
cat ${client-key} >> $f
echo "</secret>" >> $f
fi
'';
#smartphone-tcp.config = ''
# user nobody
# group nobody
# dev ${dev}
# proto tcp
# ifconfig 10.8.0.1 10.8.0.3
# secret ${client-key}
# port tcp-port
# comp-lzo
# keepalive 10 60
# ping-timer-rem
# persist-tun
# persist-key
#'';
# TODO: forward via 443
# stream {
#
# map $ssl_preread_server_name $name {
# vpn1.app.com vpn1_backend;
# vpn2.app.com vpn2_backend;
# https.app.com https_backend;
# }
#
# upstream vpn1_backend {
# server 10.0.0.3:443;
# }
#
# upstream vpn2_backend {
# server 10.0.0.4:443;
# }
#
# upstream https_backend {
# server 10.0.0.5:443;
#
# server {
# listen 10.0.0.1:443;
# proxy_pass $name;
# ssl_preread on;
# }
# }
}
|
