37 lines
1.1 KiB
Nix
37 lines
1.1 KiB
Nix
|
|
|
|
{ config, lib, pkgs, ... }:
|
|
{
|
|
config = lib.mkIf (config.syscfg.net.wg.server.enable) {
|
|
boot.kernel.sysctl = {
|
|
"net.ipv4.ip_forward" = 1;
|
|
"net.ipv6.conf.all.forwarding" = 1;
|
|
};
|
|
|
|
networking.nftables.enable = true;
|
|
networking.nftables.ruleset = ''
|
|
table inet nat {
|
|
chain prerouting {
|
|
type nat hook prerouting priority 0; policy accept;
|
|
|
|
${lib.concatMapStringsSep "\n" (ports:
|
|
let
|
|
from = builtins.elemAt ports 0;
|
|
to = builtins.elemAt ports 1;
|
|
src = builtins.elemAt ports 2;
|
|
dst = builtins.elemAt ports 3;
|
|
in ''
|
|
iifname "${from}" tcp dport ${toString src} counter dnat to ${to}:${toString dst}
|
|
iifname "${from}" udp dport ${toString src} counter dnat to ${to}:${toString dst}
|
|
''
|
|
) config.syscfg.net.wg.server.forward}
|
|
}
|
|
|
|
chain postrouting {
|
|
type nat hook postrouting priority 100; policy accept;
|
|
oifname { "wg0", "ens3" } masquerade
|
|
}
|
|
}
|
|
'';
|
|
};
|
|
} |