40 lines
1.3 KiB
Nix
40 lines
1.3 KiB
Nix
|
{ pkgs, ... }: {
|
||
|
|
users.users.grue.extraGroups = [ "networkmanager" ];
|
||
|
|
|
||
|
|
networking = {
|
||
|
|
hostName = "toaster";
|
||
|
|
firewall.enable = true;
|
||
|
|
wireguard.enable = true;
|
||
|
|
};
|
||
|
|
|
||
|
|
services.resolved = {
|
||
|
|
enable = true;
|
||
|
|
dnssec = "allow-downgrade";
|
||
|
|
fallbackDns = [
|
||
|
|
"9.9.9.9"
|
||
|
|
"2620:fe::fe"
|
||
|
|
"149.112.112.112"
|
||
|
|
"2620:fe::9"
|
||
|
|
];
|
||
|
|
};
|
||
|
|
|
||
|
|
# fixup the rpfilter fucking up the networkmanager wireguard
|
||
|
|
networking.firewall = {
|
||
|
|
# if packets are still dropped, they will show up in dmesg
|
||
|
|
logReversePathDrops = true;
|
||
|
|
# wireguard trips rpfilter up
|
||
|
|
extraCommands = ''
|
||
|
|
ip46tables -t mangle -I nixos-fw-rpfilter -p udp -m udp --sport 51820 -j RETURN
|
||
|
|
ip46tables -t mangle -I nixos-fw-rpfilter -p udp -m udp --dport 51820 -j RETURN
|
||
|
|
ip46tables -t mangle -I nixos-fw-rpfilter -p udp -m udp --sport 1337 -j RETURN
|
||
|
|
ip46tables -t mangle -I nixos-fw-rpfilter -p udp -m udp --dport 1337 -j RETURN
|
||
|
|
'';
|
||
|
|
extraStopCommands = ''
|
||
|
|
ip46tables -t mangle -D nixos-fw-rpfilter -p udp -m udp --sport 51820 -j RETURN || true
|
||
|
|
ip46tables -t mangle -D nixos-fw-rpfilter -p udp -m udp --dport 51820 -j RETURN || true
|
||
|
|
ip46tables -t mangle -D nixos-fw-rpfilter -p udp -m udp --sport 1337 -j RETURN || true
|
||
|
|
ip46tables -t mangle -D nixos-fw-rpfilter -p udp -m udp --dport 1337 -j RETURN || true
|
||
|
|
'';
|
||
|
|
};
|
||
|
|
}
|