Some experiments
This commit is contained in:
parent
a74c6d6293
commit
69b05190af
|
@ -5,4 +5,7 @@ rec {
|
|||
pc = "${localSpan}.3";
|
||||
vm = "${localSpan}.4";
|
||||
hx = "${localSpan}.70";
|
||||
|
||||
wgInt = "wg0";
|
||||
wgSpan = "10.100.0";
|
||||
}
|
||||
|
|
|
@ -26,23 +26,25 @@
|
|||
chain PREROUTING {
|
||||
type nat hook prerouting priority dstnat; policy accept;
|
||||
tcp dport 2211 dnat to ${ips.pc}:22 comment "SSH to PC"
|
||||
tcp dport 2233 dnat to ${ips.wgSpan}.3:22 comment "SSH to Oracle VM"
|
||||
|
||||
udp dport { 27005, 27015, 7777 } dnat to ${ips.pc} comment "PC Hosted Games"
|
||||
|
||||
|
||||
tcp dport { 58010, 57989, 57984 } dnat to ${ips.pc} comment "PC Sunshine TCP"
|
||||
udp dport { 57998, 57999, 58000 } dnat to ${ips.pc} comment "PC Sunshine UDP"
|
||||
|
||||
|
||||
tcp dport { 38010, 37989, 37984 } dnat to ${ips.vm} comment "VM Sunshine TCP"
|
||||
udp dport { 37998, 37999, 38000 } dnat to ${ips.vm} comment "VM Sunshine UDP"
|
||||
|
||||
|
||||
udp dport { 7790, 7791, 7792 } dnat to ${ips.hx} comment "Deus Ex"
|
||||
|
||||
|
||||
ip saddr ${outputs.secrets.cornIP} tcp dport { 9943, 9944 } dnat to ${ips.vm} comment "VM ALVR TCP"
|
||||
ip saddr ${outputs.secrets.cornIP} udp dport { 9943, 9944 } dnat to ${ips.vm} comment "VM ALVR UDP"
|
||||
}
|
||||
chain POSTROUTING {
|
||||
type nat hook postrouting priority 100; policy accept;
|
||||
oifname "${ips.netInt}" masquerade
|
||||
ip saddr 10.100.0.0/24 oifname "${ips.netInt}" masquerade comment "WireGuard"
|
||||
ip saddr ${ips.wgSpan}.0/24 oifname "${ips.netInt}" masquerade comment "WireGuard"
|
||||
}
|
||||
'';
|
||||
};
|
||||
|
|
|
@ -6,7 +6,7 @@ in {
|
|||
nat = {
|
||||
enable = true;
|
||||
externalInterface = "${ips.netInt}";
|
||||
internalInterfaces = [ "wg0" ];
|
||||
internalInterfaces = [ "${ips.wgInt}" ];
|
||||
};
|
||||
firewall.allowedUDPPorts = [ 51820 ];
|
||||
};
|
||||
|
@ -17,17 +17,17 @@ in {
|
|||
# Wireguard interface name can be arbitrary
|
||||
wg0 = {
|
||||
# Determines the IP address and subnet of the server's end of the tunnel interface.
|
||||
ips = [ "10.100.0.1/24" ];
|
||||
ips = [ "${ips.wgSpan}.1/24" ];
|
||||
listenPort = 51820;
|
||||
privateKey = outputs.secrets.wireguardPriv;
|
||||
peers = [
|
||||
{ # Jimbo Pixel 9
|
||||
publicKey = outputs.secrets.wirePixel9Pub;
|
||||
allowedIPs = [ "10.100.0.2/32" ];
|
||||
allowedIPs = [ "${ips.wgSpan}.2/32" ];
|
||||
}
|
||||
{ # Oracle VM
|
||||
publicKey = outputs.secrets.wireOraclePub;
|
||||
allowedIPs = [ "10.100.0.3/32" ];
|
||||
allowedIPs = [ "${ips.wgSpan}.3/32" ];
|
||||
}
|
||||
];
|
||||
};
|
||||
|
|
Loading…
Reference in a new issue