diff --git a/hosts/carbon/configuration.nix b/hosts/carbon/configuration.nix index 496db0f..246f916 100644 --- a/hosts/carbon/configuration.nix +++ b/hosts/carbon/configuration.nix @@ -46,6 +46,17 @@ networking.wireguard.enable = true; networking.wireguard.interfaces = { + wg-gatekeeper = { + ips = [ "fe80::127:2/64" "169.254.127.2/24" ]; + peers = [ { + allowedIPs = [ "0.0.0.0/0" "::/0" ]; + endpoint = "gatekeeper.net.clerie.de:50127"; + publicKey = "y+Bk5eIHgmnq9xuBDD+fk/OIkKRZU6AE4ISx4RdDDyg="; + persistentKeepalive = 25; + } ]; + allowedIPsAsRoutes = false; + privateKeyFile = "/var/src/secrets/wireguard/wg-gatekeeper"; + }; wg-porter = { ips = [ "fe80::138:2/64" "169.254.138.2/24" ]; peers = [ { @@ -131,6 +142,10 @@ export all; }; area 0 { + interface "wg-gatekeeper" { + cost 80; + type pointopoint; + }; interface "wg-porter" { cost 80; type pointopoint; @@ -145,6 +160,10 @@ export all; }; area 0 { + interface "wg-gatekeeper" { + cost 80; + type pointopoint; + }; interface "wg-porter" { cost 80; type pointopoint; diff --git a/hosts/gatekeeper/configuration.nix b/hosts/gatekeeper/configuration.nix index 8b1a8ff..252bd5d 100644 --- a/hosts/gatekeeper/configuration.nix +++ b/hosts/gatekeeper/configuration.nix @@ -40,6 +40,27 @@ networking.wireguard.enable = true; networking.wireguard.interfaces = { + wg-carbon = { + ips = [ "fe80::127:1/64" "169.254.127.1/24" ]; + peers = [ { + allowedIPs = [ "0.0.0.0/0" "::/0" ]; + publicKey = "5EVyQC0y704asO4SwsGbAoFGKusuO4a6IJ2bS/5bcTI="; + } ]; + listenPort = 50127; + allowedIPsAsRoutes = false; + privateKeyFile = "/var/src/secrets/wireguard/wg-carbon"; + }; + wg-nonat = { + ips = [ "fe80::128:1/64" "169.254.128.1/24" ]; + peers = [ { + allowedIPs = [ "0.0.0.0/0" "::/0" ]; + endpoint = "nonat.net.clerie.de:50128"; + publicKey = "0GGDyPj/0uMaba9pmOyj+Sx+3jMivpRdpTJhadl6bS8="; + } ]; + listenPort = 50128; + allowedIPsAsRoutes = false; + privateKeyFile = "/var/src/secrets/wireguard/wg-nonat"; + }; wg-vpn = { ips = [ "2a01:4f8:c0c:15f1::8001/113" "10.20.30.1/24" ]; peers = [ @@ -79,7 +100,7 @@ }; }; - networking.firewall.allowedUDPPorts = [ 51820 ]; + networking.firewall.allowedUDPPorts = [ 50127 50128 51820 ]; clerie.nginx-port-forward = { enable = true; @@ -101,5 +122,101 @@ }; }; + petabyte.policyrouting = { + enable = true; + rules6 = [ + { rule = "from all to fd00:152:152::/48 lookup 1000"; prio = 10000; } # OSPF + { rule = "from fd00:152:152::/48 lookup 2000"; prio = 10000; } # BGP + { rule = "from all to fd00:152:152::/48 unreachable"; prio = 20000; } + ]; + rules4 = [ + { rule = "from all to 10.152.0.0/16 lookup 1000"; prio = 10000; } # OSPF + { rule = "from 10.152.0.0/16 lookup 2000"; prio = 10000; } # BGP + { rule = "from all to 10.152.0.0/16 unreachable"; prio = 20000; } + ]; + }; + + services.bird2.enable = true; + services.bird2.config = '' + router id ${ (lib.head config.networking.interfaces.lo.ipv4.addresses).address }; + + ipv6 table ospf6; + ipv4 table ospf4; + + protocol direct { + interface "lo"; + ipv6 { + table ospf6; + }; + ipv4 { + table ospf4; + }; + } + + protocol kernel kernel_ospf6 { + kernel table 1000; + ipv6 { + table ospf6; + export filter { + krt_prefsrc=${ (lib.head config.networking.interfaces.lo.ipv6.addresses).address }; + accept; + }; + import none; + }; + } + + protocol kernel kernel_ospf4 { + kernel table 1000; + ipv4 { + table ospf4; + export filter { + krt_prefsrc=${ (lib.head config.networking.interfaces.lo.ipv4.addresses).address }; + accept; + }; + import none; + }; + } + + protocol ospf v3 ospf_6 { + ipv6 { + table ospf6; + import all; + export all; + }; + area 0 { + interface "wg-carbon" { + cost 80; + type pointopoint; + }; + interface "wg-nonat" { + cost 80; + type pointopoint; + }; + }; + } + + protocol ospf v3 ospf_4 { + ipv4 { + table ospf4; + import all; + export all; + }; + area 0 { + interface "wg-carbon" { + cost 80; + type pointopoint; + }; + interface "wg-nonat" { + cost 80; + type pointopoint; + }; + }; + } + + protocol device { + scan time 10; + } + ''; + system.stateVersion = "21.03"; } diff --git a/hosts/nonat/configuration.nix b/hosts/nonat/configuration.nix index 9980438..9689255 100644 --- a/hosts/nonat/configuration.nix +++ b/hosts/nonat/configuration.nix @@ -52,6 +52,17 @@ networking.wireguard.enable = true; networking.wireguard.interfaces = { + wg-gatekeeper = { + ips = [ "fe80::128:2/64" "169.254.128.2/24" ]; + peers = [ { + allowedIPs = [ "0.0.0.0/0" "::/0" ]; + endpoint = "gatekeeper.net.clerie.de:50128"; + publicKey = "7QHjiBbWhpOw4OX3Ye58v0YEOqhdfGJSyaHCdiCa20Q="; + } ]; + listenPort = 50128; + allowedIPsAsRoutes = false; + privateKeyFile = "/var/src/secrets/wireguard/wg-gatekeeper"; + }; wg-porter = { ips = [ "fe80::1337:2/64" "169.254.137.2/24" ]; peers = [ { @@ -65,7 +76,7 @@ }; }; - networking.firewall.allowedUDPPorts = [ 51337 ]; + networking.firewall.allowedUDPPorts = [ 50128 51337 ]; petabyte.policyrouting = { enable = true; @@ -139,6 +150,10 @@ export all; }; area 0 { + interface "wg-gatekeeper" { + cost 80; + type pointopoint; + }; interface "wg-porter" { cost 80; type pointopoint; @@ -153,6 +168,10 @@ export all; }; area 0 { + interface "wg-gatekeeper" { + cost 80; + type pointopoint; + }; interface "wg-porter" { cost 80; type pointopoint;