Connect gatekeeper to internal network
This commit is contained in:
parent
c8e98afaae
commit
ab70ee9a51
@ -46,6 +46,17 @@
|
|||||||
|
|
||||||
networking.wireguard.enable = true;
|
networking.wireguard.enable = true;
|
||||||
networking.wireguard.interfaces = {
|
networking.wireguard.interfaces = {
|
||||||
|
wg-gatekeeper = {
|
||||||
|
ips = [ "fe80::127:2/64" "169.254.127.2/24" ];
|
||||||
|
peers = [ {
|
||||||
|
allowedIPs = [ "0.0.0.0/0" "::/0" ];
|
||||||
|
endpoint = "gatekeeper.net.clerie.de:50127";
|
||||||
|
publicKey = "y+Bk5eIHgmnq9xuBDD+fk/OIkKRZU6AE4ISx4RdDDyg=";
|
||||||
|
persistentKeepalive = 25;
|
||||||
|
} ];
|
||||||
|
allowedIPsAsRoutes = false;
|
||||||
|
privateKeyFile = "/var/src/secrets/wireguard/wg-gatekeeper";
|
||||||
|
};
|
||||||
wg-porter = {
|
wg-porter = {
|
||||||
ips = [ "fe80::138:2/64" "169.254.138.2/24" ];
|
ips = [ "fe80::138:2/64" "169.254.138.2/24" ];
|
||||||
peers = [ {
|
peers = [ {
|
||||||
@ -131,6 +142,10 @@
|
|||||||
export all;
|
export all;
|
||||||
};
|
};
|
||||||
area 0 {
|
area 0 {
|
||||||
|
interface "wg-gatekeeper" {
|
||||||
|
cost 80;
|
||||||
|
type pointopoint;
|
||||||
|
};
|
||||||
interface "wg-porter" {
|
interface "wg-porter" {
|
||||||
cost 80;
|
cost 80;
|
||||||
type pointopoint;
|
type pointopoint;
|
||||||
@ -145,6 +160,10 @@
|
|||||||
export all;
|
export all;
|
||||||
};
|
};
|
||||||
area 0 {
|
area 0 {
|
||||||
|
interface "wg-gatekeeper" {
|
||||||
|
cost 80;
|
||||||
|
type pointopoint;
|
||||||
|
};
|
||||||
interface "wg-porter" {
|
interface "wg-porter" {
|
||||||
cost 80;
|
cost 80;
|
||||||
type pointopoint;
|
type pointopoint;
|
||||||
|
@ -40,6 +40,27 @@
|
|||||||
|
|
||||||
networking.wireguard.enable = true;
|
networking.wireguard.enable = true;
|
||||||
networking.wireguard.interfaces = {
|
networking.wireguard.interfaces = {
|
||||||
|
wg-carbon = {
|
||||||
|
ips = [ "fe80::127:1/64" "169.254.127.1/24" ];
|
||||||
|
peers = [ {
|
||||||
|
allowedIPs = [ "0.0.0.0/0" "::/0" ];
|
||||||
|
publicKey = "5EVyQC0y704asO4SwsGbAoFGKusuO4a6IJ2bS/5bcTI=";
|
||||||
|
} ];
|
||||||
|
listenPort = 50127;
|
||||||
|
allowedIPsAsRoutes = false;
|
||||||
|
privateKeyFile = "/var/src/secrets/wireguard/wg-carbon";
|
||||||
|
};
|
||||||
|
wg-nonat = {
|
||||||
|
ips = [ "fe80::128:1/64" "169.254.128.1/24" ];
|
||||||
|
peers = [ {
|
||||||
|
allowedIPs = [ "0.0.0.0/0" "::/0" ];
|
||||||
|
endpoint = "nonat.net.clerie.de:50128";
|
||||||
|
publicKey = "0GGDyPj/0uMaba9pmOyj+Sx+3jMivpRdpTJhadl6bS8=";
|
||||||
|
} ];
|
||||||
|
listenPort = 50128;
|
||||||
|
allowedIPsAsRoutes = false;
|
||||||
|
privateKeyFile = "/var/src/secrets/wireguard/wg-nonat";
|
||||||
|
};
|
||||||
wg-vpn = {
|
wg-vpn = {
|
||||||
ips = [ "2a01:4f8:c0c:15f1::8001/113" "10.20.30.1/24" ];
|
ips = [ "2a01:4f8:c0c:15f1::8001/113" "10.20.30.1/24" ];
|
||||||
peers = [
|
peers = [
|
||||||
@ -79,7 +100,7 @@
|
|||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
networking.firewall.allowedUDPPorts = [ 51820 ];
|
networking.firewall.allowedUDPPorts = [ 50127 50128 51820 ];
|
||||||
|
|
||||||
clerie.nginx-port-forward = {
|
clerie.nginx-port-forward = {
|
||||||
enable = true;
|
enable = true;
|
||||||
@ -101,5 +122,101 @@
|
|||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
|
petabyte.policyrouting = {
|
||||||
|
enable = true;
|
||||||
|
rules6 = [
|
||||||
|
{ rule = "from all to fd00:152:152::/48 lookup 1000"; prio = 10000; } # OSPF
|
||||||
|
{ rule = "from fd00:152:152::/48 lookup 2000"; prio = 10000; } # BGP
|
||||||
|
{ rule = "from all to fd00:152:152::/48 unreachable"; prio = 20000; }
|
||||||
|
];
|
||||||
|
rules4 = [
|
||||||
|
{ rule = "from all to 10.152.0.0/16 lookup 1000"; prio = 10000; } # OSPF
|
||||||
|
{ rule = "from 10.152.0.0/16 lookup 2000"; prio = 10000; } # BGP
|
||||||
|
{ rule = "from all to 10.152.0.0/16 unreachable"; prio = 20000; }
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
|
services.bird2.enable = true;
|
||||||
|
services.bird2.config = ''
|
||||||
|
router id ${ (lib.head config.networking.interfaces.lo.ipv4.addresses).address };
|
||||||
|
|
||||||
|
ipv6 table ospf6;
|
||||||
|
ipv4 table ospf4;
|
||||||
|
|
||||||
|
protocol direct {
|
||||||
|
interface "lo";
|
||||||
|
ipv6 {
|
||||||
|
table ospf6;
|
||||||
|
};
|
||||||
|
ipv4 {
|
||||||
|
table ospf4;
|
||||||
|
};
|
||||||
|
}
|
||||||
|
|
||||||
|
protocol kernel kernel_ospf6 {
|
||||||
|
kernel table 1000;
|
||||||
|
ipv6 {
|
||||||
|
table ospf6;
|
||||||
|
export filter {
|
||||||
|
krt_prefsrc=${ (lib.head config.networking.interfaces.lo.ipv6.addresses).address };
|
||||||
|
accept;
|
||||||
|
};
|
||||||
|
import none;
|
||||||
|
};
|
||||||
|
}
|
||||||
|
|
||||||
|
protocol kernel kernel_ospf4 {
|
||||||
|
kernel table 1000;
|
||||||
|
ipv4 {
|
||||||
|
table ospf4;
|
||||||
|
export filter {
|
||||||
|
krt_prefsrc=${ (lib.head config.networking.interfaces.lo.ipv4.addresses).address };
|
||||||
|
accept;
|
||||||
|
};
|
||||||
|
import none;
|
||||||
|
};
|
||||||
|
}
|
||||||
|
|
||||||
|
protocol ospf v3 ospf_6 {
|
||||||
|
ipv6 {
|
||||||
|
table ospf6;
|
||||||
|
import all;
|
||||||
|
export all;
|
||||||
|
};
|
||||||
|
area 0 {
|
||||||
|
interface "wg-carbon" {
|
||||||
|
cost 80;
|
||||||
|
type pointopoint;
|
||||||
|
};
|
||||||
|
interface "wg-nonat" {
|
||||||
|
cost 80;
|
||||||
|
type pointopoint;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
||||||
|
|
||||||
|
protocol ospf v3 ospf_4 {
|
||||||
|
ipv4 {
|
||||||
|
table ospf4;
|
||||||
|
import all;
|
||||||
|
export all;
|
||||||
|
};
|
||||||
|
area 0 {
|
||||||
|
interface "wg-carbon" {
|
||||||
|
cost 80;
|
||||||
|
type pointopoint;
|
||||||
|
};
|
||||||
|
interface "wg-nonat" {
|
||||||
|
cost 80;
|
||||||
|
type pointopoint;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
||||||
|
|
||||||
|
protocol device {
|
||||||
|
scan time 10;
|
||||||
|
}
|
||||||
|
'';
|
||||||
|
|
||||||
system.stateVersion = "21.03";
|
system.stateVersion = "21.03";
|
||||||
}
|
}
|
||||||
|
@ -52,6 +52,17 @@
|
|||||||
|
|
||||||
networking.wireguard.enable = true;
|
networking.wireguard.enable = true;
|
||||||
networking.wireguard.interfaces = {
|
networking.wireguard.interfaces = {
|
||||||
|
wg-gatekeeper = {
|
||||||
|
ips = [ "fe80::128:2/64" "169.254.128.2/24" ];
|
||||||
|
peers = [ {
|
||||||
|
allowedIPs = [ "0.0.0.0/0" "::/0" ];
|
||||||
|
endpoint = "gatekeeper.net.clerie.de:50128";
|
||||||
|
publicKey = "7QHjiBbWhpOw4OX3Ye58v0YEOqhdfGJSyaHCdiCa20Q=";
|
||||||
|
} ];
|
||||||
|
listenPort = 50128;
|
||||||
|
allowedIPsAsRoutes = false;
|
||||||
|
privateKeyFile = "/var/src/secrets/wireguard/wg-gatekeeper";
|
||||||
|
};
|
||||||
wg-porter = {
|
wg-porter = {
|
||||||
ips = [ "fe80::1337:2/64" "169.254.137.2/24" ];
|
ips = [ "fe80::1337:2/64" "169.254.137.2/24" ];
|
||||||
peers = [ {
|
peers = [ {
|
||||||
@ -65,7 +76,7 @@
|
|||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
networking.firewall.allowedUDPPorts = [ 51337 ];
|
networking.firewall.allowedUDPPorts = [ 50128 51337 ];
|
||||||
|
|
||||||
petabyte.policyrouting = {
|
petabyte.policyrouting = {
|
||||||
enable = true;
|
enable = true;
|
||||||
@ -139,6 +150,10 @@
|
|||||||
export all;
|
export all;
|
||||||
};
|
};
|
||||||
area 0 {
|
area 0 {
|
||||||
|
interface "wg-gatekeeper" {
|
||||||
|
cost 80;
|
||||||
|
type pointopoint;
|
||||||
|
};
|
||||||
interface "wg-porter" {
|
interface "wg-porter" {
|
||||||
cost 80;
|
cost 80;
|
||||||
type pointopoint;
|
type pointopoint;
|
||||||
@ -153,6 +168,10 @@
|
|||||||
export all;
|
export all;
|
||||||
};
|
};
|
||||||
area 0 {
|
area 0 {
|
||||||
|
interface "wg-gatekeeper" {
|
||||||
|
cost 80;
|
||||||
|
type pointopoint;
|
||||||
|
};
|
||||||
interface "wg-porter" {
|
interface "wg-porter" {
|
||||||
cost 80;
|
cost 80;
|
||||||
type pointopoint;
|
type pointopoint;
|
||||||
|
Loading…
Reference in New Issue
Block a user