Use wireguard instead of strongswan since its in the kernel
Signed-off-by: Egor Savkin <es@m-labs.hk>
This commit is contained in:
parent
ebe55e2fa6
commit
4ae7af98b2
|
@ -90,7 +90,7 @@ in
|
||||||
hostId = "e423f012";
|
hostId = "e423f012";
|
||||||
firewall = {
|
firewall = {
|
||||||
allowedTCPPorts = [ 53 80 443 2222 7402 ];
|
allowedTCPPorts = [ 53 80 443 2222 7402 ];
|
||||||
allowedUDPPorts = [ 53 67 500 4500 ];
|
allowedUDPPorts = [ 53 67 500 4500 51820 ];
|
||||||
trustedInterfaces = [ netifLan ];
|
trustedInterfaces = [ netifLan ];
|
||||||
};
|
};
|
||||||
useDHCP = false;
|
useDHCP = false;
|
||||||
|
@ -227,29 +227,6 @@ in
|
||||||
}
|
}
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
greTunnels.intl0 = {
|
|
||||||
dev = netifWan;
|
|
||||||
remote = "5.78.16.0";
|
|
||||||
local = "94.190.212.123";
|
|
||||||
ttl = 255;
|
|
||||||
type = "tun";
|
|
||||||
};
|
|
||||||
interfaces.intl0 = {
|
|
||||||
ipv4.addresses = [
|
|
||||||
{
|
|
||||||
address = "10.42.0.2";
|
|
||||||
prefixLength = 30;
|
|
||||||
}
|
|
||||||
];
|
|
||||||
ipv4.routes = [
|
|
||||||
{
|
|
||||||
address = "0.0.0.0";
|
|
||||||
prefixLength = 0;
|
|
||||||
via = "10.42.0.1";
|
|
||||||
options.table = "3";
|
|
||||||
}
|
|
||||||
];
|
|
||||||
};
|
|
||||||
vlans = {
|
vlans = {
|
||||||
"${netifAltVlan}" = {
|
"${netifAltVlan}" = {
|
||||||
id = 2;
|
id = 2;
|
||||||
|
@ -269,6 +246,21 @@ in
|
||||||
}
|
}
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
|
wireguard.interfaces = {
|
||||||
|
intl0 = {
|
||||||
|
ips = [ "10.42.0.2/32" ];
|
||||||
|
listenPort = 51820;
|
||||||
|
privateKeyFile = "/path/to/private/key";
|
||||||
|
peers = [
|
||||||
|
{
|
||||||
|
publicKey = "4RozbGZ9ENCjvJXGMB5aK1oqyZfD4UCarEHjSckwVGI=";
|
||||||
|
allowedIPs = [ "0.0.0.0/0" ];
|
||||||
|
endpoint = "5.78.86.156:51820";
|
||||||
|
persistentKeepalive = 25;
|
||||||
|
}
|
||||||
|
];
|
||||||
|
};
|
||||||
|
};
|
||||||
};
|
};
|
||||||
boot.kernel.sysctl."net.ipv6.conf.all.forwarding" = "1";
|
boot.kernel.sysctl."net.ipv6.conf.all.forwarding" = "1";
|
||||||
boot.kernel.sysctl."net.ipv6.conf.default.forwarding" = "1";
|
boot.kernel.sysctl."net.ipv6.conf.default.forwarding" = "1";
|
||||||
|
@ -302,27 +294,6 @@ in
|
||||||
after = [ "network-addresses-${netifAlt}.service" ];
|
after = [ "network-addresses-${netifAlt}.service" ];
|
||||||
requires = [ "network-addresses-${netifAlt}.service" ];
|
requires = [ "network-addresses-${netifAlt}.service" ];
|
||||||
};
|
};
|
||||||
services.strongswan-swanctl.swanctl.connections.intl = {
|
|
||||||
local_addrs = [ "94.190.212.123" ];
|
|
||||||
remote_addrs = [ "5.78.16.0" ];
|
|
||||||
local.main = {
|
|
||||||
auth = "pubkey";
|
|
||||||
id = "fqdn:m-labs.hk";
|
|
||||||
pubkeys = [ "/etc/swanctl/pubkey/m-labs.hk" ];
|
|
||||||
};
|
|
||||||
remote.main = {
|
|
||||||
auth = "pubkey";
|
|
||||||
id = "fqdn:m-labs-intl.com";
|
|
||||||
pubkeys = [ "/etc/swanctl/pubkey/m-labs-intl.com" ];
|
|
||||||
};
|
|
||||||
children.intl0 = {
|
|
||||||
mode = "transport";
|
|
||||||
ah_proposals = [ "sha256-curve25519" ];
|
|
||||||
remote_ts = [ "5.78.16.0[gre]" ];
|
|
||||||
local_ts = [ "94.190.212.123[gre]" ];
|
|
||||||
start_action = "start";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
systemd.services.network-custom-route-backup = {
|
systemd.services.network-custom-route-backup = {
|
||||||
wantedBy = [ "network.target" ];
|
wantedBy = [ "network.target" ];
|
||||||
|
@ -342,15 +313,6 @@ in
|
||||||
ExecStop = "${pkgs.iproute2}/bin/ip rule del table 1";
|
ExecStop = "${pkgs.iproute2}/bin/ip rule del table 1";
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
systemd.services.network-custom-route-intl = {
|
|
||||||
wantedBy = [ "network.target" ];
|
|
||||||
serviceConfig = {
|
|
||||||
Type = "oneshot";
|
|
||||||
RemainAfterExit = true;
|
|
||||||
ExecStart = "${pkgs.iproute2}/bin/ip rule add from 5.78.16.0/32 table 3";
|
|
||||||
ExecStop = "${pkgs.iproute2}/bin/ip rule del table 3";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
# https://kb.isc.org/docs/dnssec-key-and-signing-policy
|
# https://kb.isc.org/docs/dnssec-key-and-signing-policy
|
||||||
# chown named.named /etc/nixos/named
|
# chown named.named /etc/nixos/named
|
||||||
|
|
|
@ -22,7 +22,8 @@ $TTL 7200
|
||||||
ns A 94.190.212.123
|
ns A 94.190.212.123
|
||||||
ns AAAA 2001:470:18:390::2
|
ns AAAA 2001:470:18:390::2
|
||||||
|
|
||||||
mail A 5.78.16.0
|
mail A 5.78.86.156
|
||||||
|
mail AAAA 2a01:4ff:1f0:83de::1
|
||||||
mail._domainkey IN TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJVPuhSGXghO7ib8Em/Se3jfCCIJK5g4zn5pGZ3/e0I0f+zGHMuvwpjkAKf6eSmo/AAXEaco28pDi3qE5xfV512AJsORCfPoPFyNhLsj/qtri6hc5KVSWW0Ja3MSFBINDCaX78c7PXPY+3jJJGpwSBDLjdxj9AQwtfiCVlH4qE/QIDAQAB"
|
mail._domainkey IN TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJVPuhSGXghO7ib8Em/Se3jfCCIJK5g4zn5pGZ3/e0I0f+zGHMuvwpjkAKf6eSmo/AAXEaco28pDi3qE5xfV512AJsORCfPoPFyNhLsj/qtri6hc5KVSWW0Ja3MSFBINDCaX78c7PXPY+3jJJGpwSBDLjdxj9AQwtfiCVlH4qE/QIDAQAB"
|
||||||
_dmarc TXT "v=DMARC1; p=none"
|
_dmarc TXT "v=DMARC1; p=none"
|
||||||
|
|
||||||
|
|
Loading…
Reference in New Issue