From 7b98b49fcdd5c9cf1044a19c85c3d2ec9f49b4dd Mon Sep 17 00:00:00 2001 From: Egor Savkin Date: Wed, 11 Sep 2024 11:04:36 +0800 Subject: [PATCH] Apply tested client configuration Adds an additional route, but doesn't enforce it so other apps will remain the same, but smtp can use tunnel for sending. Also sends replies through the tunnel if connection arrives on the tunnel. Better have something tested and working before I start doing "perfect". Signed-off-by: Egor Savkin --- nixbld-etc-nixos/configuration.nix | 23 +++++++++++++++++++++-- 1 file changed, 21 insertions(+), 2 deletions(-) diff --git a/nixbld-etc-nixos/configuration.nix b/nixbld-etc-nixos/configuration.nix index 395e856..9cfbdba 100644 --- a/nixbld-etc-nixos/configuration.nix +++ b/nixbld-etc-nixos/configuration.nix @@ -281,13 +281,32 @@ in }; wireguard.interfaces = { intl0 = { - ips = [ "10.42.0.2/32" ]; + ips = [ "10.42.0.2/30" ]; listenPort = 51820; - privateKeyFile = "/path/to/private/key"; + privateKeyFile = "/path/to/private/key"; # just `wg-quick genkey > /path/to/private/key` + postUp = '' + ${pkgs.iproute2}/bin/ip rule add from all fwmark 1 lookup 51820 + ${pkgs.iproute2}/bin/ip route add default via 10.42.0.1 dev intl0 table 51820 + ${pkgs.iptables}/bin/iptables -t mangle -A PREROUTING -i intl0 -p tcp -j MARK --set-mark 1 + ${pkgs.iptables}/bin/iptables -A OUTPUT -o intl0 -m connmark --mark 1 -j ACCEPT + ${pkgs.iptables}/bin/iptables -A INPUT -i intl0 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT + ${pkgs.iptables}/bin/iptables -t mangle -A PREROUTING -m conntrack --ctstate NEW -i intl0 -p tcp -j CONNMARK --save-mark + ${pkgs.iptables}/bin/iptables -t mangle -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j CONNMARK --restore-mark + ''; + preDown = '' + ${pkgs.iproute2}/bin/ip rule del from all fwmark 1 lookup 51820 + ${pkgs.iproute2}/bin/ip route del default via 10.42.0.1 dev intl0 table 51820 + ${pkgs.iptables}/bin/iptables -t mangle -D PREROUTING -i intl0 -p tcp -j MARK --set-mark 1 + ${pkgs.iptables}/bin/iptables -D OUTPUT -o intl0 -m connmark --mark 1 -j ACCEPT + ${pkgs.iptables}/bin/iptables -D INPUT -i intl0 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT + ${pkgs.iptables}/bin/iptables -t mangle -D PREROUTING -m conntrack --ctstate NEW -i intl0 -p tcp -j CONNMARK --save-mark + ${pkgs.iptables}/bin/iptables -t mangle -D OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j CONNMARK --restore-mark + ''; peers = [ { publicKey = "4RozbGZ9ENCjvJXGMB5aK1oqyZfD4UCarEHjSckwVGI="; allowedIPs = [ "0.0.0.0/0" ]; + allowedIPsAsRoutes = false; endpoint = "5.78.86.156:51820"; persistentKeepalive = 25; }