chvp/nixos-config
1
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

Use udp2raw to traverse UPD-blocking networks

Browse source
This commit is contained in:
Charlotte Van Petegem 2022-11-24 15:51:53 +01:00
parent 9d610059e5
commit 3056e9f281
No known key found for this signature in database
GPG key ID: 019E764B7184435A
4 changed files with 117 additions and 56 deletions
Download patch file Download diff file Expand all files Collapse all files

4
flake.nix
View file

@ -99,6 +99,7 @@
emacs-overlay.overlay
(self: super: {
tetris = tetris.packages.${self.system}.default;
udp2raw = self.callPackage ./packages/udp2raw { };
})
nur.overlay
www-chvp-be.overlay
@ -131,6 +132,9 @@
nameToValue = name: import (./shells + "/${name}.nix") { inherit pkgs inputs; };
in
builtins.listToAttrs (builtins.map (name: { inherit name; value = nameToValue name; }) shellNames);
packages = {
udp2raw = pkgs.callPackage ./packages/udp2raw { };
};
};
};
}

13
machines/kharbranth/default.nix
View file

@ -12,12 +12,15 @@
stateVersion = "20.09";
base = {
bluetooth.enable = true;
network.mobile = {
enable = true;
wireless-interface = "wlp0s20f3";
wired-interfaces = {
"enp0s13f0u2u2" = { };
network = {
mobile = {
enable = true;
wireless-interface = "wlp0s20f3";
wired-interfaces = {
"enp0s13f0u2u2" = { };
};
};
wireguard.onCorporate = true;
};
zfs = {
encrypted = true;

130
modules/base/network/wireguard.nix
View file

@ -36,10 +36,17 @@ in
default = false;
example = true;
};
onCorporate = lib.mkOption {
default = false;
example = true;
};
};
config = {
networking.firewall.allowedUDPPorts = lib.optional config.chvp.base.network.wireguard.server 51820;
networking.firewall.trustedInterfaces = [ "wg0" ];
networking.firewall = {
allowedUDPPorts = lib.optional config.chvp.base.network.wireguard.server 51820;
allowedTCPPorts = lib.optional config.chvp.base.network.wireguard.server 8080;
trustedInterfaces = [ "wg0" ];
};
boot.kernel.sysctl = lib.mkIf config.chvp.base.network.wireguard.server { "net.ipv4.ip_forward" = 1; };
services.unbound = lib.mkIf config.chvp.base.network.wireguard.server {
enable = true;
@ -68,59 +75,80 @@ in
};
};
};
systemd.network = {
netdevs.wg0 = {
enable = true;
netdevConfig = {
Name = "wg0";
Kind = "wireguard";
};
wireguardConfig =
if config.chvp.base.network.wireguard.server then {
PrivateKeyFile = data.${config.networking.hostName}.privkeyFile;
ListenPort = 51820;
} else {
PrivateKeyFile = data.${config.networking.hostName}.privkeyFile;
systemd = {
network = {
netdevs.wg0 = {
enable = true;
netdevConfig = {
Name = "wg0";
Kind = "wireguard";
MTUBytes = "1342";
};
wireguardPeers =
if config.chvp.base.network.wireguard.server then
(builtins.map
(name: {
wireguardPeerConfig = {
PublicKey = data.${name}.pubkey;
AllowedIPs = "${data.${name}.ip}/32";
PresharedKeyFile = pskFile;
};
})
(builtins.filter (name: name != config.networking.hostName) (builtins.attrNames data)))
else
([{
wireguardPeerConfig = {
PublicKey = data.lasting-integrity.pubkey;
AllowedIPs = subnet;
Endpoint = "lasting-integrity.vanpetegem.me:51820";
PresharedKeyFile = pskFile;
PersistentKeepalive = 25;
};
}]);
};
networks.wg0 = {
enable = true;
name = "wg0";
address = [ "${data.${config.networking.hostName}.ip}/32" ];
domains = [ "local" ];
dns = [ data.lasting-integrity.ip ];
routes = [{
routeConfig =
wireguardConfig =
if config.chvp.base.network.wireguard.server then {
Gateway = "${data.${config.networking.hostName}.ip}";
Destination = subnet;
PrivateKeyFile = data.${config.networking.hostName}.privkeyFile;
ListenPort = 51820;
} else {
Gateway = "${data.lasting-integrity.ip}";
Destination = subnet;
GatewayOnLink = true;
PrivateKeyFile = data.${config.networking.hostName}.privkeyFile;
};
}];
wireguardPeers =
if config.chvp.base.network.wireguard.server then
(builtins.map
(name: {
wireguardPeerConfig = {
PublicKey = data.${name}.pubkey;
AllowedIPs = "${data.${name}.ip}/32";
PresharedKeyFile = pskFile;
};
})
(builtins.filter (name: name != config.networking.hostName) (builtins.attrNames data)))
else
([{
wireguardPeerConfig = {
PublicKey = data.lasting-integrity.pubkey;
AllowedIPs = subnet;
Endpoint =
if config.chvp.base.network.wireguard.onCorporate
then "127.0.0.1:51820"
else "lasting-integrity.vanpetegem.me:51820";
PresharedKeyFile = pskFile;
PersistentKeepalive = 25;
};
}]);
};
networks.wg0 = {
enable = true;
name = "wg0";
address = [ "${data.${config.networking.hostName}.ip}/32" ];
domains = [ "local" ];
dns = [ data.lasting-integrity.ip ];
linkConfig.MTUBytes = "1342";
routes = [{
routeConfig =
if config.chvp.base.network.wireguard.server then {
Gateway = "${data.${config.networking.hostName}.ip}";
Destination = subnet;
} else {
Gateway = "${data.lasting-integrity.ip}";
Destination = subnet;
GatewayOnLink = true;
};
}];
};
};
services = {
udp2raw-server = lib.mkIf config.chvp.base.network.wireguard.server {
description = "UDP tunnel over TCP for wireguard";
wantedBy = [ "multi-user.target" ];
after = [ "network.target" ];
script = "${pkgs.udp2raw}/bin/udp2raw -s -l 0.0.0.0:8080 -r 127.0.0.1:51820 -k 'secret'";
};
udp2raw-client = lib.mkIf config.chvp.base.network.wireguard.onCorporate {
description = "UDP tunnel over TCP for wireguard";
wantedBy = [ "multi-user.target" ];
after = [ "network.target" ];
script = "${pkgs.udp2raw}/bin/udp2raw -c -l 127.0.0.1:51820 -r 54.38.222.69:8080 -k 'secret'";
};
};
};
age.secrets."files/wireguard/psk" = {

26
packages/udp2raw/default.nix Normal file
View file

@ -0,0 +1,26 @@
{ lib
, stdenv
, fetchFromGitHub
, makeWrapper
, iptables
}:
stdenv.mkDerivation rec {
pname = "udp2raw";
version = "20200818.0";
src = fetchFromGitHub {
owner = "wangyu-";
repo = "udp2raw";
rev = version;
hash = "sha256-TkTOfF1RfHJzt80q0mN4Fek3XSFY/8jdeAVtyluZBt8=";
};
nativeBuildInputs = [ makeWrapper ];
buildPhase = "make dynamic";
installPhase = ''
mkdir -p $out/bin
cp udp2raw_dynamic $out/bin/udp2raw
wrapProgram $out/bin/udp2raw --prefix PATH : "${lib.makeBinPath [ iptables ]}"
'';
}