nydragon/nix-da
1
Fork 0
Code Issues Pull requests Activity Actions 1

feat(iwd): use iwd as networkmanager backend and put wg port in var

Browse source
This commit is contained in:
Nydragon 2024-06-13 21:39:06 +09:00
parent d805d9c3e5
commit 24a4b6d124
No known key found for this signature in database
GPG key ID: 14AA30A865EA1209
1 changed files with 38 additions and 28 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

66
modules/networking.nix
View file

@ -1,34 +1,44 @@
{ ... }:
{
networking.firewall = {
enable = true;
networking = {
wireless.iwd.enable = true;
# Open ports in the firewall.
allowedTCPPorts = [ ];
allowedUDPPorts = [ 51820 ];
allowedTCPPortRanges = [
{
from = 1714;
to = 1764;
}
];
allowedUDPPortRanges = [
{
from = 1714;
to = 1764;
}
];
networkmanager.wifi.backend = "iwd";
# if packets are still dropped, they will show up in dmesg
logReversePathDrops = true;
# wireguard trips rpfilter up https://nixos.wiki/wiki/WireGuard#Setting_up_WireGuard_with_NetworkManager
extraCommands = ''
ip46tables -t mangle -I nixos-fw-rpfilter -p udp -m udp --sport 51820 -j RETURN
ip46tables -t mangle -I nixos-fw-rpfilter -p udp -m udp --dport 51820 -j RETURN
'';
extraStopCommands = ''
ip46tables -t mangle -D nixos-fw-rpfilter -p udp -m udp --sport 51820 -j RETURN || true
ip46tables -t mangle -D nixos-fw-rpfilter -p udp -m udp --dport 51820 -j RETURN || true
'';
firewall =
let
wgPort = 51820;
in
{
enable = true;
# Open ports in the firewall.
allowedTCPPorts = [ ];
allowedUDPPorts = [ wgPort ];
allowedTCPPortRanges = [
{
from = 1714;
to = 1764;
}
];
allowedUDPPortRanges = [
{
from = 1714;
to = 1764;
}
];
# if packets are still dropped, they will show up in dmesg
logReversePathDrops = true;
# wireguard trips rpfilter up https://nixos.wiki/wiki/WireGuard#Setting_up_WireGuard_with_NetworkManager
extraCommands = ''
ip46tables -t mangle -I nixos-fw-rpfilter -p udp -m udp --sport ${toString wgPort} -j RETURN
ip46tables -t mangle -I nixos-fw-rpfilter -p udp -m udp --dport ${toString wgPort} -j RETURN
'';
extraStopCommands = ''
ip46tables -t mangle -D nixos-fw-rpfilter -p udp -m udp --sport ${toString wgPort} -j RETURN || true
ip46tables -t mangle -D nixos-fw-rpfilter -p udp -m udp --dport ${toString wgPort} -j RETURN || true
'';
};
};
}