sokai/mynixos-config
1
1
Fork 0
forked from mirrors_public/oddlama_nix-config
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: ajust firewall rule names and wireguard link name to match

Browse source
This commit is contained in:
oddlama 2023-05-20 19:35:17 +02:00
parent 3862bd6b14
commit 0221a24225
No known key found for this signature in database
GPG key ID: 14EFE510775FE39A
3 changed files with 31 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

2
hosts/ward/net.nix
View file

@ -98,7 +98,7 @@ in {
zones = lib.mkForce { zones = lib.mkForce {
lan.interfaces = ["lan-self"]; lan.interfaces = ["lan-self"];
wan.interfaces = ["wan"]; wan.interfaces = ["wan"];
"local-vms".interfaces = ["wg-local-vms"]; local-vms.interfaces = ["local-vms"];
}; };
rules = lib.mkForce { rules = lib.mkForce {

21
modules/microvms.nix
View file

@ -165,7 +165,7 @@
networking.nftables.firewall = { networking.nftables.firewall = {
zones = mkForce { zones = mkForce {
"${vmCfg.networking.mainLinkName}".interfaces = [vmCfg.networking.mainLinkName]; "${vmCfg.networking.mainLinkName}".interfaces = [vmCfg.networking.mainLinkName];
"local-vms".interfaces = ["wg-local-vms"]; local-vms.interfaces = ["local-vms"];
}; };
rules = mkForce { rules = mkForce {
@ -175,7 +175,7 @@
}; };
local-vms-to-local = { local-vms-to-local = {
from = ["wg-local-vms"]; from = ["local-vms"];
to = ["local"]; to = ["local"];
}; };
}; };
@ -193,6 +193,7 @@
via = nodeName; via = nodeName;
keepalive = false; keepalive = false;
}; };
linkName = "local-vms";
ipv4 = net.cidr.host vmCfg.id cfg.networking.wireguard.cidrv4; ipv4 = net.cidr.host vmCfg.id cfg.networking.wireguard.cidrv4;
ipv6 = net.cidr.host vmCfg.id cfg.networking.wireguard.cidrv6; ipv6 = net.cidr.host vmCfg.id cfg.networking.wireguard.cidrv6;
}; };
@ -401,9 +402,25 @@ in {
inherit (cfg.networking) host; inherit (cfg.networking) host;
inherit (cfg.networking.wireguard) openFirewallRules port; inherit (cfg.networking.wireguard) openFirewallRules port;
}; };
linkName = "local-vms";
ipv4 = net.cidr.host 1 cfg.networking.wireguard.cidrv4; ipv4 = net.cidr.host 1 cfg.networking.wireguard.cidrv4;
ipv6 = net.cidr.host 1 cfg.networking.wireguard.cidrv6; ipv6 = net.cidr.host 1 cfg.networking.wireguard.cidrv6;
}; };
# Create a firewall zone for the secure vm traffic
# TODO mkForce nftables
networking.nftables.firewall = {
zones = mkForce {
local-vms.interfaces = ["local-vms"];
};
rules = mkForce {
local-vms-to-local = {
from = ["local-vms"];
to = ["local"];
};
};
};
} }
// extraLib.mergeToplevelConfigs ["disko" "microvm" "systemd"] (mapAttrsToList microvmConfig vms) // extraLib.mergeToplevelConfigs ["disko" "microvm" "systemd"] (mapAttrsToList microvmConfig vms)
); );

15
modules/wireguard.nix
View file

@ -87,11 +87,12 @@
# Adds context information to the assertions for this network # Adds context information to the assertions for this network
assertionPrefix = "Wireguard network '${wgName}' on '${nodeName}'"; assertionPrefix = "Wireguard network '${wgName}' on '${nodeName}'";
# Calculates which traffic should be routed to a given server node # Calculates the allowed ips for another server from our perspective.
# Usually we just want to allow other peers to route traffic # Usually we just want to allow other peers to route traffic
# for our "children" through us, additional to traffic to us of course. # for our "children" through us, additional to traffic to us of course.
# If a server exposes additional network access (global, lan, ...), # If a server exposes additional network access (global, lan, ...),
# these can be added aswell. TODO (do that) # these can be added aswell.
# TODO (do that)
serverAllowedIPs = serverNode: let serverAllowedIPs = serverNode: let
snCfg = wgCfgOf serverNode; snCfg = wgCfgOf serverNode;
in in
@ -160,7 +161,7 @@
systemd.network.netdevs."${toString wgCfg.priority}-${wgName}" = { systemd.network.netdevs."${toString wgCfg.priority}-${wgName}" = {
netdevConfig = { netdevConfig = {
Kind = "wireguard"; Kind = "wireguard";
Name = "${wgName}"; Name = wgCfg.linkName;
Description = "Wireguard network ${wgName}"; Description = "Wireguard network ${wgName}";
}; };
wireguardConfig = wireguardConfig =
@ -228,7 +229,7 @@
}; };
systemd.network.networks."${toString wgCfg.priority}-${wgName}" = { systemd.network.networks."${toString wgCfg.priority}-${wgName}" = {
matchConfig.Name = wgName; matchConfig.Name = wgCfg.linkName;
address = map toNetworkAddr wgCfg.addresses; address = map toNetworkAddr wgCfg.addresses;
}; };
}; };
@ -315,6 +316,12 @@ in {
description = mdDoc "The order priority used when creating systemd netdev and network files."; description = mdDoc "The order priority used when creating systemd netdev and network files.";
}; };
linkName = mkOption {
default = "wg-${name}";
type = types.str;
description = mdDoc "The name for the created network interface.";
};
ipv4 = mkOption { ipv4 = mkOption {
type = net.types.ipv4; type = net.types.ipv4;
description = mdDoc "The ipv4 address for this machine."; description = mdDoc "The ipv4 address for this machine.";