asmir/nixos_flake_config
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

magpie/networking: iptables -> nftables

Browse Source
This commit is contained in:
Asmir A 2025-02-10 15:15:44 +01:00
parent f7246dc661
commit a624cbcfd1
Signed by: asmir
GPG Key ID: 020C42B7A9ABA3E2
1 changed files with 24 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
magpie/configuration.nix
View File

@ -333,24 +333,28 @@
}; };
networking.hostName = "magpie"; networking.hostName = "magpie";
networking.firewall = {
networking.firewall.enable = true; nftables.enable = true;
networking.firewall.allowedTCPPorts = [ enable = true;
allowedTCPPorts = [
80 80
443 443
587 587
2049 2049
]; # http, mail, mail, nfs ]; # http, mail, mail, nfs
networking.firewall.allowedUDPPorts = [ allowedUDPPorts = [
443 443
51820 51820
]; # mail, wireguard ]; # mail, wireguard
networking.firewall.allowPing = true; allowPing = true;
networking.firewall.logRefusedConnections = lib.mkDefault false; logRefusedConnections = lib.mkDefault false;
};
networking.nat.enable = true; networking.nat = {
networking.nat.externalInterface = "enp1s0"; enable = true;
networking.nat.internalInterfaces = [ "wg0" ]; externalInterface = "enp1s0";
internalInterfaces = [ "wg0" ];
};
networking.networkmanager.enable = true; networking.networkmanager.enable = true;
networking.wireless.enable = false; networking.wireless.enable = false;
@ -363,11 +367,11 @@
# This allows the wireguard server to route your traffic to the internet and hence be like a VPN # This allows the wireguard server to route your traffic to the internet and hence be like a VPN
# For this to work you have to set the dnsserver IP of your router (or dnsserver of choice) in your clients # For this to work you have to set the dnsserver IP of your router (or dnsserver of choice) in your clients
postSetup = '' postSetup = ''
${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.100.0.0/24 -o eth0 -j MASQUERADE ${pkgs.nftables}/bin/nft add rule ip nat POSTROUTING oifname "eth0" ip saddr 10.100.0.0/24 counter masquerade
''; '';
# This undoes the above command # This undoes the above command, TODO fix command below to be more specific
postShutdown = '' postShutdown = ''
${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.100.0.0/24 -o eth0 -j MASQUERADE ${pkgs.nftables}/bin/nft flush table ip nat
''; '';
privateKeyFile = config.sops.secrets."wg_privkey".path; privateKeyFile = config.sops.secrets."wg_privkey".path;