nydragon/nix-da
1
Fork 0
Code Issues Pull requests Activity Actions 1

feat(iwd): use iwd as networkmanager backend and put wg port in var

Browse source
This commit is contained in:
Nydragon 2024-06-13 21:39:06 +09:00
parent d805d9c3e5
commit 24a4b6d124
No known key found for this signature in database
GPG key ID: 14AA30A865EA1209
1 changed files with 38 additions and 28 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

22
modules/networking.nix
View file

@ -1,11 +1,20 @@
{ ... }:
{
networking.firewall = {
networking = {
wireless.iwd.enable = true;
networkmanager.wifi.backend = "iwd";
firewall =
let
wgPort = 51820;
in
{
enable = true;
# Open ports in the firewall.
allowedTCPPorts = [ ];
allowedUDPPorts = [ 51820 ];
allowedUDPPorts = [ wgPort ];
allowedTCPPortRanges = [
{
from = 1714;
@ -23,12 +32,13 @@
logReversePathDrops = true;
# wireguard trips rpfilter up https://nixos.wiki/wiki/WireGuard#Setting_up_WireGuard_with_NetworkManager
extraCommands = ''
ip46tables -t mangle -I nixos-fw-rpfilter -p udp -m udp --sport 51820 -j RETURN
ip46tables -t mangle -I nixos-fw-rpfilter -p udp -m udp --dport 51820 -j RETURN
ip46tables -t mangle -I nixos-fw-rpfilter -p udp -m udp --sport ${toString wgPort} -j RETURN
ip46tables -t mangle -I nixos-fw-rpfilter -p udp -m udp --dport ${toString wgPort} -j RETURN
'';
extraStopCommands = ''
ip46tables -t mangle -D nixos-fw-rpfilter -p udp -m udp --sport 51820 -j RETURN || true
ip46tables -t mangle -D nixos-fw-rpfilter -p udp -m udp --dport 51820 -j RETURN || true
ip46tables -t mangle -D nixos-fw-rpfilter -p udp -m udp --sport ${toString wgPort} -j RETURN || true
ip46tables -t mangle -D nixos-fw-rpfilter -p udp -m udp --dport ${toString wgPort} -j RETURN || true
'';
};
};
}