From 2f1c11d7790792dec7b53d1f724f4e23899ac08f Mon Sep 17 00:00:00 2001 From: Egor Savkin Date: Wed, 11 Sep 2024 11:28:03 +0800 Subject: [PATCH] Ip rules instead of iptables tracking Signed-off-by: Egor Savkin --- nixbld-etc-nixos/configuration.nix | 14 ++------------ 1 file changed, 2 insertions(+), 12 deletions(-) diff --git a/nixbld-etc-nixos/configuration.nix b/nixbld-etc-nixos/configuration.nix index 68831b7..58a4305 100644 --- a/nixbld-etc-nixos/configuration.nix +++ b/nixbld-etc-nixos/configuration.nix @@ -252,22 +252,12 @@ in listenPort = 51820; privateKeyFile = "/path/to/private/key"; # just `wg-quick genkey > /path/to/private/key` postUp = '' - ${pkgs.iproute2}/bin/ip rule add from all fwmark 1 lookup 51820 + ${pkgs.iproute2}/bin/ip rule add from 10.42.0.0/30 lookup 51820 ${pkgs.iproute2}/bin/ip route add default via 10.42.0.1 dev intl0 table 51820 - ${pkgs.iptables}/bin/iptables -t mangle -A PREROUTING -i intl0 -p tcp -j MARK --set-mark 1 - ${pkgs.iptables}/bin/iptables -A OUTPUT -o intl0 -m connmark --mark 1 -j ACCEPT - ${pkgs.iptables}/bin/iptables -A INPUT -i intl0 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT - ${pkgs.iptables}/bin/iptables -t mangle -A PREROUTING -m conntrack --ctstate NEW -i intl0 -p tcp -j CONNMARK --save-mark - ${pkgs.iptables}/bin/iptables -t mangle -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j CONNMARK --restore-mark ''; preDown = '' - ${pkgs.iproute2}/bin/ip rule del from all fwmark 1 lookup 51820 + ${pkgs.iproute2}/bin/ip rule del from 10.42.0.0/30 lookup 51820 ${pkgs.iproute2}/bin/ip route del default via 10.42.0.1 dev intl0 table 51820 - ${pkgs.iptables}/bin/iptables -t mangle -D PREROUTING -i intl0 -p tcp -j MARK --set-mark 1 - ${pkgs.iptables}/bin/iptables -D OUTPUT -o intl0 -m connmark --mark 1 -j ACCEPT - ${pkgs.iptables}/bin/iptables -D INPUT -i intl0 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT - ${pkgs.iptables}/bin/iptables -t mangle -D PREROUTING -m conntrack --ctstate NEW -i intl0 -p tcp -j CONNMARK --save-mark - ${pkgs.iptables}/bin/iptables -t mangle -D OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j CONNMARK --restore-mark ''; peers = [ {