kevin/dotfiles
1
0
Fork 0
mirror of https://github.com/Unkn0wnCat/dotfiles.git synced 2025-05-11 07:06:35 +02:00
Code Issues Projects Releases Wiki Activity

Switch to flake-based configuration

Browse source
This commit is contained in:
Kevin Kandlbinder 2023-02-27 13:34:57 +00:00
parent fad1c56a56
commit f17713236d
25 changed files with 578 additions and 216 deletions
Download patch file Download diff file Expand all files Collapse all files

22
nixos/modules/firewall/wireguard.nix Normal file
View file

@ -0,0 +1,22 @@
{ lib, ... }:
let
wireguardPort = 51820;
in
{
networking.firewall = {
# if packets are still dropped, they will show up in dmesg
logReversePathDrops = true;
allowedUDPPorts = [ wireguardPort ];
# wireguard trips rpfilter up
extraCommands = ''
ip46tables -t mangle -I nixos-fw-rpfilter -p udp -m udp --sport ${toString wireguardPort} -j RETURN
ip46tables -t mangle -I nixos-fw-rpfilter -p udp -m udp --dport ${toString wireguardPort} -j RETURN
'';
extraStopCommands = ''
ip46tables -t mangle -D nixos-fw-rpfilter -p udp -m udp --sport ${toString wireguardPort} -j RETURN || true
ip46tables -t mangle -D nixos-fw-rpfilter -p udp -m udp --dport ${toString wireguardPort} -j RETURN || true
'';
};
}