{ config, pkgs, ... }: let port = 51820; in { # enable NAT networking.nat = { enable = true; externalInterface = "eth0"; internalInterfaces = [ "wg0" ]; }; networking.firewall = { allowedUDPPorts = [ port ]; }; networking.wireguard.interfaces = { # "wg0" is the network interface name. You can name the interface arbitrarily. wg0 = { # Determines the IP address and subnet of the server's end of the tunnel interface. ips = [ "10.100.0.1/24" ]; # The port that WireGuard listens to. Must be accessible by the client. listenPort = port; # This allows the wireguard server to route your traffic to the internet and hence be like a VPN # For this to work you have to set the dnsserver IP of your router (or dnsserver of choice) in your clients postSetup = '' ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.100.0.0/24 -o eth0 -j MASQUERADE ''; # This undoes the above command postShutdown = '' ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.100.0.0/24 -o eth0 -j MASQUERADE ''; # Path to the private key file. privateKeyFile = config.age.secrets.wireguard-canigou-private.path; peers = [ # List of allowed peers. { # Home publicKey = "Gg+p7tysAhu2X841weBiQrqoKXh6kvcmDiCY62rLwQg="; # List of IPs assigned to this peer within the tunnel subnet. Used to configure routing. allowedIPs = [ "10.100.0.2/32" ]; } { # Asus publicKey = "mzVH0N3q7UE/XjMwgRks+D8KFuIj91VkOK2ytgjsnkw="; allowedIPs = [ "10.100.0.3/32" ]; } ]; }; }; age.secrets.wireguard-canigou-private = { file = ../../../secrets/wireguard-canigou-private.age; mode = "0400"; }; }