From 3884eb2f82b93ebd9112f6a04c62a8a7d26662dd Mon Sep 17 00:00:00 2001
From: Grigory Shipunov
Date: Sat, 29 Oct 2022 20:38:12 +0200
Subject: yolo

---
 hosts/microwave/stateful-networking.nix | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)
 create mode 100644 hosts/microwave/stateful-networking.nix

(limited to 'hosts/microwave/stateful-networking.nix')

diff --git a/hosts/microwave/stateful-networking.nix b/hosts/microwave/stateful-networking.nix
new file mode 100644
index 0000000..1c89ae3
--- /dev/null
+++ b/hosts/microwave/stateful-networking.nix
@@ -0,0 +1,30 @@
+{ pkgs, config, ... }: {
+  networking = {
+    hostName = "microwave"; # Define your hostname.
+    hostId = "7da4f1e6";
+    firewall.enable = true;
+    wireguard.enable = true;
+    # wireless.iwd.enable = true;
+    # networkmanager.wifi.backend = "iwd";
+  };
+
+  # fix networkmanager wireguard
+ networking.firewall = {
+   # if packets are still dropped, they will show up in dmesg
+   logReversePathDrops = true;
+   # wireguard trips rpfilter up
+   extraCommands = ''
+     ip46tables -t mangle -I nixos-fw-rpfilter -p udp -m udp --sport 51820 -j RETURN
+     ip46tables -t mangle -I nixos-fw-rpfilter -p udp -m udp --dport 51820 -j RETURN
+   '';
+   extraStopCommands = ''
+     ip46tables -t mangle -D nixos-fw-rpfilter -p udp -m udp --sport 51820 -j RETURN || true
+     ip46tables -t mangle -D nixos-fw-rpfilter -p udp -m udp --dport 51820 -j RETURN || true
+   '';
+  };
+
+  services.resolved = {
+    enable = true;
+    dnssec = "allow-downgrade";
+  };
+}
-- 
cgit v1.3.1