hairpin for host from wg1HEADmaster

1 files changed, 20 insertions, 1 deletions

diff --git a/hosts/poweredge/networking.nix b/hosts/poweredge/networking.nix
index bf0aa1c..790f009 100644
--- a/hosts/poweredge/networking.nix
+++ b/hosts/poweredge/networking.nix
@@ -1,6 +1,6 @@
 let
 	hostIp = "192.168.1.10";
-in { config, ... }: {
+in { pkgs, config, ... }: {
 	networking = {
 		# Label lan and wan interfaces
 		_interfaceLabels = {
@@ -109,6 +109,20 @@ in { config, ... }: {
 								}
 						'';
 						};
+						# Hairpin for wg1 clients to access the host via veth-router-lan since path is broken otherwise
+						host-hairpin = {
+							family = "ip";
+							content = ''
+								chain pre {
+									type nat hook prerouting priority dstnat; policy accept;
+									iifname "wg1" ip daddr 192.168.1.10 dnat to 10.255.255.2 comment "wg1 => host, redirect via veth"
+								}
+								chain post {
+									type nat hook postrouting priority srcnat; policy accept;
+									ip daddr 10.255.255.2 masquerade comment "wg1 => host, hairpin masquerade"
+								}
+							'';
+						};
 					};
 				};
 			};
@@ -130,6 +144,11 @@ in { config, ... }: {
 				hageziBlocklists = [ "pro" "nsfw" ];
 			};
 
+
+			environment.systemPackages = with pkgs; [
+				tcpdump
+			];
+
 			system.stateVersion = "25.11";
 		};
 	};