45 lines
1.1 KiB
Nix
45 lines
1.1 KiB
Nix
|
|
|
|
{ config, lib, pkgs, ... }:
|
|
|
|
with lib;
|
|
|
|
let
|
|
cfg = config.syscfg.net.wg;
|
|
|
|
in
|
|
{
|
|
|
|
config = lib.mkIf (config.syscfg.net.wg.server.enable) {
|
|
boot.kernel.sysctl = {
|
|
"net.ipv4.ip_forward" = 1;
|
|
"net.ipv6.conf.all.forwarding" = 1;
|
|
};
|
|
|
|
networking.nftables.enable = true;
|
|
networking.nftables.ruleset = ''
|
|
table inet nat {
|
|
chain prerouting {
|
|
type nat hook prerouting priority 0; policy accept;
|
|
|
|
${concatMapStringsSep "\n" (ports:
|
|
let
|
|
from = builtins.elemAt ports 0;
|
|
to = builtins.elemAt ports 1;
|
|
src = builtins.elemAt ports 2;
|
|
dst = builtins.elemAt ports 3;
|
|
in ''
|
|
iifname "${from}" tcp dport ${toString src} counter dnat to ${to}:${toString dst}
|
|
iifname "${from}" udp dport ${toString src} counter dnat to ${to}:${toString dst}
|
|
''
|
|
) cfg.forwarding.ports}
|
|
}
|
|
|
|
chain postrouting {
|
|
type nat hook postrouting priority 100; policy accept;
|
|
oifname { "wg0", "ens3" } masquerade
|
|
}
|
|
}
|
|
'';
|
|
};
|
|
} |