sora/nixconfig
1
0 Fork 1
Code Issues 2 Pull Requests Actions Releases Activity

wg routing fix
update.yml (push) Invalid workflow file
Details

Browse Source
This commit is contained in:
sora committed 2026-11-01 12:12:59 +01:00
1 parent 9a99024688
commit 6998f64d88
1 file changed
+8
Download Patch File Download Diff File Expand all files Collapse all files
modules/server/nftables/default.nix
+8
View File
@@ -1,6 +1,9 @@
{ config, lib, ... }:
let
cfg = config.syscfg.server;
wg = cfg.wireguard && config.syscfg.net.wg.enable;
wgIp4 = builtins.head (lib.splitString "/" config.syscfg.net.wg.ip4);
wgIp6 = builtins.head (lib.splitString "/" config.syscfg.net.wg.ip6);
in {
config = lib.mkIf (cfg.ipfw.enable) {
boot.kernel.sysctl = {
@@ -27,6 +30,11 @@ in {
iifname "${srcInt}" tcp dport ${srcPort} counter dnat ip6 to [${dstAddr6}]:${dstPort}
iifname "${srcInt}" udp dport ${srcPort} counter dnat ip6 to [${dstAddr6}]:${dstPort}
'' + lib.optionalString wg ''
iifname "wg0" fib daddr type local ip daddr != ${wgIp4} tcp dport ${srcPort} counter dnat ip to ${dstAddr4}:${dstPort}
iifname "wg0" fib daddr type local ip daddr != ${wgIp4} udp dport ${srcPort} counter dnat ip to ${dstAddr4}:${dstPort}
iifname "wg0" fib daddr type local ip6 daddr != ${wgIp6} tcp dport ${srcPort} counter dnat ip6 to [${dstAddr6}]:${dstPort}
iifname "wg0" fib daddr type local ip6 daddr != ${wgIp6} udp dport ${srcPort} counter dnat ip6 to [${dstAddr6}]:${dstPort}
''
) cfg.ipfw.ports}
}