From 8ec65b9d39f3a8f9b4039abe7ba6f15031c15843 Mon Sep 17 00:00:00 2001 From: Tim Keller Date: Mon, 5 Oct 2026 15:33:19 -0500 Subject: wg update and routing for flex --- hosts/flex-wg-router/configuration.nix | 10 ++++++++++ hosts/flex-wg-router/resources/secrets/wg.yaml | 6 +++--- hosts/flex-wg-router/wg.nix | 2 -- 3 files changed, 13 insertions(+), 5 deletions(-) (limited to 'hosts/flex-wg-router') diff --git a/hosts/flex-wg-router/configuration.nix b/hosts/flex-wg-router/configuration.nix index 22fd06d..3f6ad06 100644 --- a/hosts/flex-wg-router/configuration.nix +++ b/hosts/flex-wg-router/configuration.nix @@ -48,6 +48,16 @@ in { allowedUDPPorts = [ 51820 ]; }; }; + # NAT/masquerade lan0 allowing wg0 clients to access lan0 + nftables.tables.wg-nat = { + family = "ip"; + content = '' + chain post { + type nat hook postrouting priority srcnat; policy accept; + iifname "wg0" oifname "lan0" masquerade comment "wg0 => lan0" + } + ''; + }; }; # Router config diff --git a/hosts/flex-wg-router/resources/secrets/wg.yaml b/hosts/flex-wg-router/resources/secrets/wg.yaml index 97867cc..f3dbfd5 100644 --- a/hosts/flex-wg-router/resources/secrets/wg.yaml +++ b/hosts/flex-wg-router/resources/secrets/wg.yaml @@ -1,5 +1,5 @@ wg1: ENC[AES256_GCM,data:GDmORbMvBY9vQ0eppWM71eABSVFgGeoGD7CTu5otyAWr/fGKraGaRKHnj3i/wTQV2oxeI1eBKJoAcNI4vdoS584pffo9qXi5A8xQ6UppqEdqbMGqsoiVElGbJXoZxx9Lgl0abgy9DOvMNFhWQzEPnqW/QRXxzClsazB0oveafqx1cXMnU4WestLKvCyK7UL5GVCrp18qw2UzIeuoTY9zyQ3Dt9/Tmlg9tsjLy4bWmTyrgyeYOKc2x0Aocxz6yvadN76Vp6vm9Fcxvu0szxBrVauIxCzqpL6pyy3wvLm+aka6CkLhviZ38GtZ8GXXSqB1Lf52mz3udKqLZAau1ANqfAhzKqUapKPxn+fpo+JIIRw4+boXtO/3Z8YPjiyUQcFrhRkSCI7cm2w+rCcm/p+2YiBPpMGSCDcyJqZeKbgM8MPkpbr3EEg4ruqNJYN/cnk=,iv:O8QYsHCEzTW6Y4s31OKjjcAxAToQwLfAIEzCtUZT6IM=,tag:M0Juai3qMJiabN1kgYLvOA==,type:str] -wg0: ENC[AES256_GCM,data:YIu2svPOijXaEUAbzH+5hAwd8XpSZrq3OwfWj+q0lH63ug4zs3poNlUXShZLKYJTZ+cyyKyfXGNu0NG4p0dNHH988bCeRyLE21ih54acYRCIpd7WLvV1whJhdl2NgFyhDPEDkY0RQQ447NnU/juSyAWf4wf36vR6OCWvWvsVzecIiZw9DzJT5oyy+Ao1LWrW6UxVKi85pM11KrbcZOvBjLsiaSwa9Y9cmS4LY+N/yKLJLbI1txVJ3naLAKToJn3WnRKutB8NA39wlWpSHjlqCsKKkyfl6Cj8/LWDcYlxU8YqBFX75Cm683TAqzRxCqsPFDsmxfx8oi8OODnpXSkq8wQMdlw4bc+JVRr/mtVCsx9OrigIOhJ9ftMugaYC32LRPKvpD3eYylVDNJncLulekPeMoytzWakAs6AKE3Z4DwQqimAHQIiteD903aSWlWpk6/WypXrSMVBp7fdklAvKhBhoPwFwmJyjY/cWz3qLkovCgk95Go4xstFdDBKz2FDmNlG8IJBTm0clRumUjW2amtHevmn1jRZyPXc2z1xJv+6vuHe5jfyuSHZOjbuYmn4s/0hRpMNWS1DfQ5TIvJa4TKPXEmYrxx1So1zOZUF6,iv:Cd7iHHGIEy5w99kPuMb8FDl/YqXjEYvQx80ZkUYXmCI=,tag:SlWiPnjgiNO0eexNLN5hxA==,type:str] +wg0: ENC[AES256_GCM,data:VXmlGbNFz02RY2jG5FqgDpnBOdPncSR+DSGhJqAVoBrt8K49KgDiCRHcbly13rPwyi52nwRLC3HlOnSjNOuuayebUNiPGQYXTbBeBmPLgUQDqEeXWxblm0lZl619d0EjGPunEoMmml7FBDE4jnH2Rxpvy3NeE7EBRM4XbkQbOuMZ0DD7x0hgxjbd7oZgR5smZFedFhXZmz0oIH0+7tpbycy5gHqusxbTapB1khuUFUwCCbHyPCLa5o7Eq0JMGzCQAJHcmadUueFdiEvpMT7UZ7SNhdSEacwxaMu63+UGbYm06hFEw/CJC0fS5oQZ3d7FOxVWvHB5Yr9Yd2Z6rnqPPTJIV3tnuCtX/uNZQTqw8oiyVv98bzSSCdsEPsaKLPkzSVxaIaJhTyVarWY69fcjL/szpBx7d6u58rIZtcDEK9WhQP6YDrF9kls1Ilb8/kTQlF4sbFOr1Wur/mUEXsMOVBX6rIGj4mzSD0DAPV9wql0O2bNxxsv2JAFQU99Rux3DjtMj/Zof/sSGUkEpcD0kkvi0ghOrRqXvkEFuNV+xAwTd09+58xuIJfi4W+S1HyExFqAKGqnvqo4i3hZwbhK1Ih6neyqFLifndPgbkuuX,iv:W/v3DwHFLjyuODJzYRMbLGoPN8TtJfoLnJ4Xf0i3AQc=,tag:VFqTrkaA8JzFLrLlVntokw==,type:str] sops: age: - recipient: age1f0tmpy2nam58skmznjyqd3zf54rxtfrk6fda0vlpq9y3yg6wac7sjf0vja @@ -11,7 +11,7 @@ sops: L25wUWRJbzZMZDFseXdvOFJXQVRxN28KJjC3ola24tTEV8tFYpnsId4d0S+jHkS9 ME6i4jorWRlQKdYn/gTUoqgMAvJEc73hjTfgX6bFshhuhflfGxXQQw== -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-09-25T00:06:41Z" - mac: ENC[AES256_GCM,data:GfZuouwOTP+vTI2v+YLwpfrR9gNWp7eEpK7Tau/jetn47mReM7JOJmRp02i5mRviPjGIkwK7cAxD9UEDzHCgZ4iVOm6wXgXaVbz3c/ITFlCUEE5UxBy37H5qabjr4EVCTb/HPQYivNPtMIKvPnfIbG9Khkt7h7I9AuIcm7IfANM=,iv:QKok3xgciaLCS0YMZxOxoUW/zsV+gXVpPexvcmoban8=,tag:0eArscx+gmB4GIgigQrZvA==,type:str] + lastmodified: "2026-10-05T20:28:02Z" + mac: ENC[AES256_GCM,data:Gs50iWwnnOyTnAYBBbHz9hQNV/20K/cd9V17Z01Zefm44J7e2TnQzyYcnPIEfJEhDeFoI+9stYYNRu2VCdP1s+yVsMhVb/xgendElvnSApKa/RycbQdOfe6Pw3Z4hrKVDjU47GMHTVSQlFc/1m+kWvKTl3UPpv16aTop4aMyuaQ=,iv:/B6Cz41LDx0E9VsIqE0xWlWtvmCGc4RasqQMl9PJd7w=,tag:aznqp995DY4Mh70U61m9yw==,type:str] unencrypted_suffix: _unencrypted version: 3.12.1 diff --git a/hosts/flex-wg-router/wg.nix b/hosts/flex-wg-router/wg.nix index 814a48d..9ff9395 100644 --- a/hosts/flex-wg-router/wg.nix +++ b/hosts/flex-wg-router/wg.nix @@ -1,9 +1,7 @@ { config, pkgs, inputs, ... }: { sops.secrets.wg0.sopsFile = ./resources/secrets/wg.yaml; - sops.secrets.wg1.sopsFile = ./resources/secrets/wg.yaml; networking.wg-quick.interfaces = { wg0.configFile = config.sops.secrets.wg0.path; - #wg1.configFile = config.sops.secrets.wg1.path; }; } -- cgit v1.3.1