fi/nix-infra
1
1
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

Fix WireGuard nat rules

Browse source
This commit is contained in:
fi 2023-09-18 03:38:09 +02:00
parent f67a75b07d
commit e7fe3707ee
Signed by: fi
SSH key fingerprint: SHA256:d+6fQoDPMbSFK95zRVflRKZLRKF4cPSQb7VIxYkhFsA
11 changed files with 269 additions and 61 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

39
config/hosts/lifeline/configuration.nix
View file

@ -1,4 +1,4 @@
{ ... }:
{ pkgs, ... }:
{
boot.loader.grub = {
enable = true;
@ -14,6 +14,43 @@
enable = true;
allowedUDPPorts = [ 51820 ];
};
# mail-2 VPN
wireguard = {
enable = true;
interfaces.wg0 = {
listenPort = 51820;
ips = [
"172.16.50.1/24"
];
peers = [
{
name = "mail-2";
publicKey = "OIBOJlFzzM3P/u1ftVW2HWt8kA6NveB4PaBOIXhCYhM=";
presharedKeyFile = "/secrets/wireguard-lifeline-mail-2-lifeline-psk.secret";
allowedIPs = [ "172.16.50.2/32" ];
}
];
postSetup = ''
${pkgs.iptables}/bin/iptables -A FORWARD -i wg0 -j ACCEPT
${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 172.16.50.0/24 -o ens6 -j MASQUERADE
'';
postShutdown = ''
${pkgs.iptables}/bin/iptables -D FORWARD -i wg0 -j ACCEPT
${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 172.16.50.0/24 -o ens6 -j MASQUERADE
'';
privateKeyFile = "/secrets/wireguard-lifeline-wg0-privatekey.secret";
};
};
nat = {
enable = true;
internalInterfaces = [ "wg0" ];
externalInterface = "ens6";
forwardPorts = [{
destination = "172.16.50.2:25";
proto = "tcp";
sourcePort = 25;
}];
};
};
services.prometheus.exporters.node.enable = false;

8
config/hosts/lifeline/secrets.nix
View file

@ -1,15 +1,15 @@
{ ... }:
{
deployment.keys."wireguard-lifeline-mail-1-lifeline-psk.secret" = {
keyCommand = [ "env" "GNUPGHOME=/home/yuri/.passinfra_gnupg" "PASSWORD_STORE_DIR=/home/yuri/pass/infra" "pass" "wireguard/lifeline-mail-1/psk" ];
deployment.keys."wireguard-lifeline-wg0-privatekey.secret" = {
keyCommand = [ "env" "GNUPGHOME=/home/yuri/.passinfra_gnupg" "PASSWORD_STORE_DIR=/home/yuri/pass/infra" "pass" "wireguard/lifeline-wg0-privatekey" ];
destDir = "/secrets";
user = "root";
group = "root";
permissions = "0640";
uploadAt = "pre-activation";
};
deployment.keys."wireguard-lifeline-mail-1-lifeline-privatekey.secret" = {
keyCommand = [ "env" "GNUPGHOME=/home/yuri/.passinfra_gnupg" "PASSWORD_STORE_DIR=/home/yuri/pass/infra" "pass" "wireguard/lifeline-mail-1/lifeline-privatekey" ];
deployment.keys."wireguard-lifeline-mail-2-lifeline-psk.secret" = {
keyCommand = [ "env" "GNUPGHOME=/home/yuri/.passinfra_gnupg" "PASSWORD_STORE_DIR=/home/yuri/pass/infra" "pass" "wireguard/lifeline-mail-2/psk" ];
destDir = "/secrets";
user = "root";
group = "root";

120
config/hosts/mail-1/configuration.nix
View file

@ -1,61 +1,91 @@
{ hosts, ... }:
{ pkgs, ... }:
{
boot.loader.grub = {
enable = true;
device = "/dev/vda";
};
networking = {
hostName = "mail-1";
useDHCP = true;
defaultGateway = {
address = "172.16.50.1";
interface = "wg0";
};
interfaces.enp6s18.ipv4 = {
routes = [
{
address = "10.201.0.0";
prefixLength = 16;
via = "10.202.41.1";
}
{
address = "10.202.0.0";
prefixLength = 16;
via = "10.202.41.1";
}
{
address = "172.21.87.0"; # management VPN
prefixLength = 24;
via = "10.202.41.1";
}
{
address = "212.53.203.19"; # valkyrie.af.grzb.de
prefixLength = 32;
via = "10.202.41.1";
}
];
};
wireguard = {
enable = true;
interfaces.wg0 = {
ips = [
"172.16.50.2/24"
systemd.network = {
enable = true;
networks = {
"enp6s18" = {
matchConfig.Name = "enp6s18";
address = [
"10.202.41.123/24"
];
peers = [
routes = [
{
name = "valkyrie";
publicKey = "ik480irMZtGBs1AFpf1KGzDBekjdziD3ck7XK8r1WXQ=";
presharedKeyFile = "/secrets/wireguard-valkyrie-mail-1-mail-1-psk.secret";
endpoint = "212.53.203.19:51822";
allowedIPs = [ "0.0.0.0/0" ];
persistentKeepalive = 25;
routeConfig = {
Gateway = "10.202.41.1";
Destination = "10.201.0.0/16";
};
}
{
routeConfig = {
Gateway = "10.202.41.1";
Destination = "10.202.0.0/16";
};
}
{
routeConfig = {
Gateway = "10.202.41.1";
Destination = "172.21.87.0/24";
};
}
{
routeConfig = {
Gateway = "10.202.41.1";
Destination = "212.53.203.19/32";
};
}
];
privateKeyFile = "/secrets/wireguard-mail-1-wg0-privatekey.secret";
linkConfig.RequiredForOnline = "routable";
};
"wg0" = {
matchConfig.Name = "wg0";
address = [
"172.16.50.2/24"
];
DHCP = "no";
gateway = [
"172.16.50.1"
];
};
};
netdevs = {
"wg0" = {
netdevConfig = {
Kind = "wireguard";
Name = "wg0";
};
wireguardConfig = {
PrivateKeyFile = "/secrets/wireguard-mail-1-wg0-privatekey.secret";
};
wireguardPeers = [{
wireguardPeerConfig = {
PublicKey = "ik480irMZtGBs1AFpf1KGzDBekjdziD3ck7XK8r1WXQ=";
PresharedKeyFile = "/secrets/wireguard-valkyrie-mail-1-mail-1-psk.secret";
Endpoint = "212.53.203.19:51822";
AllowedIPs = [ "0.0.0.0/0" ];
PersistentKeepalive = 25;
};
}];
};
};
};
networking = {
hostName = "mail-1";
useDHCP = false;
firewall = {
enable = true;
allowedTCPPorts = [ 25 465 993 ];
};
};
environment.systemPackages = with pkgs; [
wireguard-tools
];
system.stateVersion = "23.05";
}

3
config/hosts/mail-1/simple-nixos-mailserver.nix
View file

@ -59,8 +59,11 @@
services.postfix = {
transport = "relay:[mail-2.grzb.de]";
<<<<<<< HEAD
extraConfig = ''
proxy_interfaces = 212.53.203.19
'';
=======
>>>>>>> 0e55e66 (Use systemd-networkd on mail servers)
};
}

91
config/hosts/mail-2/configuration.nix Normal file
View file

@ -0,0 +1,91 @@
{ pkgs, ... }:
{
boot.loader.grub = {
enable = true;
device = "/dev/vda";
};
systemd.network = {
enable = true;
networks = {
"enp6s18" = {
matchConfig.Name = "enp6s18";
address = [
"10.201.41.100/24"
];
routes = [
{
routeConfig = {
Gateway = "10.201.41.1";
Destination = "10.201.0.0/16";
};
}
{
routeConfig = {
Gateway = "10.201.41.1";
Destination = "10.202.0.0/16";
};
}
{
routeConfig = {
Gateway = "10.201.41.1";
Destination = "172.21.87.0/24";
};
}
{
routeConfig = {
Gateway = "10.201.41.1";
Destination = "217.160.117.160/32";
};
}
];
linkConfig.RequiredForOnline = "routable";
};
"wg0" = {
matchConfig.Name = "wg0";
address = [
"172.16.50.2/24"
];
DHCP = "no";
gateway = [
"172.16.50.1"
];
};
};
netdevs = {
"wg0" = {
netdevConfig = {
Kind = "wireguard";
Name = "wg0";
};
wireguardConfig = {
PrivateKeyFile = "/secrets/wireguard-mail-2-wg0-privatekey.secret";
};
wireguardPeers = [{
wireguardPeerConfig = {
PublicKey = "Nnf7x+Yd+l8ZkK2BTq1lK3iiTYgdrgL9PQ/je8smug4=";
PresharedKeyFile = "/secrets/wireguard-lifeline-mail-2-mail-2-psk.secret";
Endpoint = "217.160.117.160:51820";
AllowedIPs = [ "0.0.0.0/0" ];
PersistentKeepalive = 25;
};
}];
};
};
};
networking = {
hostName = "mail-2";
useDHCP = false;
firewall = {
enable = true;
allowedTCPPorts = [ 25 ];
};
};
environment.systemPackages = with pkgs; [
wireguard-tools
];
system.stateVersion = "23.05";
}

7
config/hosts/mail-2/default.nix Normal file
View file

@ -0,0 +1,7 @@
{ ... }:
{
imports = [
./configuration.nix
./postfix.nix
];
}

17
config/hosts/mail-2/postfix.nix Normal file
View file

@ -0,0 +1,17 @@
{ ... }: {
# Postfix relay configuration, see: https://www.postfix.org/STANDARD_CONFIGURATION_README.html#backup
services.postfix = {
enable = true;
hostname = "mail-2.grzb.de";
relayDomains = [
"grzb.de"
"nekover.se"
];
extraConfig = ''
message_size_limit = 20971520
smtpd_relay_restrictions = permit_mynetworks reject_unauth_destination
proxy_interfaces = 217.160.117.160
relay_recipient_maps =
'';
};
}

19
config/hosts/mail-2/secrets.nix Normal file
View file

@ -0,0 +1,19 @@
{ ... }:
{
deployment.keys."wireguard-mail-2-wg0-privatekey.secret" = {
keyCommand = [ "env" "GNUPGHOME=/home/yuri/.passinfra_gnupg" "PASSWORD_STORE_DIR=/home/yuri/pass/infra" "pass" "wireguard/mail-2-wg0-privatekey" ];
destDir = "/secrets";
user = "root";
group = "systemd-network";
permissions = "0640";
uploadAt = "pre-activation";
};
deployment.keys."wireguard-lifeline-mail-2-mail-2-psk.secret" = {
keyCommand = [ "env" "GNUPGHOME=/home/yuri/.passinfra_gnupg" "PASSWORD_STORE_DIR=/home/yuri/pass/infra" "pass" "wireguard/lifeline-mail-2/psk" ];
destDir = "/secrets";
user = "root";
group = "systemd-network";
permissions = "0640";
uploadAt = "pre-activation";
};
}

10
config/hosts/valkyrie/configuration.nix
View file

@ -35,7 +35,7 @@
allowedIPs = [ "10.203.10.2/32" "10.202.0.0/16" ];
}
{
name = "site2-jsts";
name = "site1-jsts";
publicKey = "u9h+D8XZ62ABnetBRKnf6tjs+tJwM8fQ4d6ipOCLFyE=";
presharedKeyFile = "/secrets/wireguard-valkyrie-site1-jsts-psk.secret";
endpoint = "site1.jsts.xyz:51823";
@ -59,12 +59,12 @@
}
];
postSetup = ''
${pkgs.iptables}/bin/iptables -A FORWARD -i wg0 -j ACCEPT
${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 172.16.50.0/24 -o ens6 -j MASQUERADE
${pkgs.iptables}/bin/iptables -A FORWARD -i wg1 -j ACCEPT
${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 172.16.50.0/24 -o ens3 -j MASQUERADE
'';
postShutdown = ''
${pkgs.iptables}/bin/iptables -D FORWARD -i wg0 -j ACCEPT
${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 172.16.50.0/24 -o ens6 -j MASQUERADE
${pkgs.iptables}/bin/iptables -D FORWARD -i wg1 -j ACCEPT
${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 172.16.50.0/24 -o ens3 -j MASQUERADE
'';
privateKeyFile = "/secrets/wireguard-valkyrie-wg1-privatekey.secret";
};

12
flake.lock
View file

@ -70,11 +70,11 @@
},
"nixpkgs": {
"locked": {
"lastModified": 1694493899,
"narHash": "sha256-46zEnn7H/G2ne735wEEKKW+LoyPa6NOWj2P9InxDfJs=",
"lastModified": 1695011647,
"narHash": "sha256-A0iKkey2LBlKCvwMR0HDXSs7ubdFP3ly8YE3m2zS/L4=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "c5167858ca4870e933da123762eb55363ccefe2b",
"rev": "4d2bff6897a5434eef9bd958c7e89c96dec569e0",
"type": "github"
},
"original": {
@ -116,11 +116,11 @@
},
"nixpkgs-unstable": {
"locked": {
"lastModified": 1694502577,
"narHash": "sha256-MMW8BMlRU38Zewova/BOYy3ER+GM2nPln+UYeHI9EsI=",
"lastModified": 1694928810,
"narHash": "sha256-M/3+pRQmM+FeBeSKRp0b01pncbNiiC2ggJE4Wpi7c1Q=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "55ec5ae7d6c3f7866a0696a6ccfb66a1665b3d72",
"rev": "948e8754755a9f27587d5bd109af2cfad313add8",
"type": "github"
},
"original": {

4
hosts.nix
View file

@ -53,6 +53,10 @@ in
site = "vs";
environment = "proxmox";
};
mail-2 = {
site = "wg";
environment = "proxmox";
};
matrix = {
site = "vs";
environment = "proxmox";