lasuite-federez/nix
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

dedicated nftables

Browse source
This commit is contained in:
asyncnomi 2025-07-22 00:05:56 +02:00
parent 395a34d811
commit ff133ea171
9 changed files with 28 additions and 23 deletions
Download patch file Download diff file Expand all files Collapse all files

8
shared/commons/mesh.nix
View file

@ -51,6 +51,7 @@ let
"172.19.128.0/17"
"fc00:f::/96"
];
endpoint = "${builtins.head (builtins.split "/" peerConfig.ip4)}:${toString (51000 + myId)}";
persistentKeepalive = 25;
}];
# Throw away route created by wireguard
@ -68,7 +69,7 @@ let
${pkgs.iproute2}/bin/ip -6 route replace fc00::${toString myId}:${toString peerConfig.id} dev mesh-${shorten peerName}-${toString peerConfig.zone}-${toString peerConfig.id} scope link
# Return path for mgmt trafic
${if !(lib.elem myPeer mapping.bastion) && (lib.elem peerName mapping.bastion) then ''
${if lib.elem peerName mapping.bastion then ''
${pkgs.iproute2}/bin/ip route replace 172.19.${toString (peerConfig.zone + 127)}.0/24 via 172.19.${toString myPeer.id}.${toString peerConfig.id} dev mesh-${shorten peerName}-${toString peerConfig.zone}-${toString peerConfig.id}
${pkgs.iproute2}/bin/ip -6 route replace fc00:f::${toString (peerConfig.zone + 127)}:0/96 via fc00::${toString myPeer.id}:${toString peerConfig.id} dev mesh-${shorten peerName}-${toString peerConfig.zone}-${toString peerConfig.id}
'' else ""}
@ -107,9 +108,4 @@ in
ExecStart = "${wireguardStaticRoute}/bin/wireguardStaticRoute";
};
};
# Open UDP port for wireguard traffic
networking.firewall.allowedUDPPorts = lib.range 51000 (51000 + builtins.head (
builtins.sort (a: b: a > b) (
lib.mapAttrsToList (name: node: node.id) nodes)));
}