diff --git a/nixbld-etc-nixos/configuration.nix b/nixbld-etc-nixos/configuration.nix
index 395e856..9cfbdba 100644
--- a/nixbld-etc-nixos/configuration.nix
+++ b/nixbld-etc-nixos/configuration.nix
@@ -281,13 +281,32 @@ in
     };
     wireguard.interfaces = {
       intl0 = {
-        ips = [ "10.42.0.2/32" ];
+        ips = [ "10.42.0.2/30" ];
         listenPort = 51820;
-        privateKeyFile = "/path/to/private/key";
+        privateKeyFile = "/path/to/private/key"; # just `wg-quick genkey > /path/to/private/key`
+        postUp = ''
+          ${pkgs.iproute2}/bin/ip rule add from all fwmark 1 lookup 51820
+          ${pkgs.iproute2}/bin/ip route add default via 10.42.0.1 dev intl0 table 51820
+          ${pkgs.iptables}/bin/iptables -t mangle -A PREROUTING -i intl0 -p tcp -j MARK --set-mark 1
+          ${pkgs.iptables}/bin/iptables -A OUTPUT -o intl0 -m connmark --mark 1 -j ACCEPT
+          ${pkgs.iptables}/bin/iptables -A INPUT -i intl0 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
+          ${pkgs.iptables}/bin/iptables -t mangle -A PREROUTING -m conntrack --ctstate NEW -i intl0 -p tcp -j CONNMARK --save-mark
+          ${pkgs.iptables}/bin/iptables -t mangle -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j CONNMARK --restore-mark
+        '';
+        preDown = ''
+          ${pkgs.iproute2}/bin/ip rule del from all fwmark 1 lookup 51820
+          ${pkgs.iproute2}/bin/ip route del default via 10.42.0.1 dev intl0 table 51820
+          ${pkgs.iptables}/bin/iptables -t mangle -D PREROUTING -i intl0 -p tcp -j MARK --set-mark 1
+          ${pkgs.iptables}/bin/iptables -D OUTPUT -o intl0 -m connmark --mark 1 -j ACCEPT
+          ${pkgs.iptables}/bin/iptables -D INPUT -i intl0 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
+          ${pkgs.iptables}/bin/iptables -t mangle -D PREROUTING -m conntrack --ctstate NEW -i intl0 -p tcp -j CONNMARK --save-mark
+          ${pkgs.iptables}/bin/iptables -t mangle -D OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j CONNMARK --restore-mark
+        '';
         peers = [
           {
             publicKey = "4RozbGZ9ENCjvJXGMB5aK1oqyZfD4UCarEHjSckwVGI=";
             allowedIPs = [ "0.0.0.0/0" ];
+            allowedIPsAsRoutes = false;
             endpoint = "5.78.86.156:51820";
             persistentKeepalive = 25;
           }