Migrate gateway

modules/nixos/system/network/wireguard/forwarding.nix

@@ -0,0 +1,43 @@
+
+
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.syscfg.net.wg;
+
+in
+{
+  
+  config = lib.mkIf (config.syscfg.net.wg.server.enable) {
+    boot.kernel.sysctl = {
+      "net.ipv4.ip_forward" = 1;
+      "net.ipv6.conf.all.forwarding" = 1;
+    };
+
+    networking.nftables.enable = true;
+    networking.nftables.ruleset = ''
+      table inet nat {
+        chain prerouting {
+          type nat hook prerouting priority 0; policy accept;
+          
+          ${concatMapStringsSep "\n" (ports:
+            let
+              src = builtins.elemAt ports 0;
+              dst = builtins.elemAt ports 1;
+            in ''
+              iifname "${cfg.inInterface}" tcp dport ${toString src} counter dnat to ${cfg.toAddr}:${toString dst}
+              iifname "${cfg.inInterface}" udp dport ${toString src} counter dnat to ${cfg.toAddr}:${toString dst}
+            ''
+          ) cfg.forwarding.ports}
+        }
+        
+        chain postrouting {
+          type nat hook postrouting priority 100; policy accept;
+          oifname { "wg0", "ens3" } masquerade
+        }
+      }
+    '';
+  };
+}