48 lines
1.6 KiB
Nix
48 lines
1.6 KiB
Nix
{ config, pkgs, ... }:
|
|
{
|
|
networking.wireguard.enable = true;
|
|
networking.wireguard.interfaces = {
|
|
wg-mullvad = {
|
|
# Use a separate network namespace for the VPN.
|
|
# sudo ip netns exec wg-qbittorrent curl --interface wg-mullvad https://am.i.mullvad.net/connected
|
|
|
|
privateKeyFile = "/etc/secrets/vpn.txt";
|
|
ips = ["10.155.12.117/32" "fd7d:76ee:e68f:a993:3523:7cc2:943c:18a9/128"];
|
|
interfaceNamespace = "wg-mullvad-namespace";
|
|
mtu = 1320;
|
|
|
|
preSetup = ''
|
|
ip netns add wg-mullvad-namespace
|
|
ip -n wg-mullvad-namespace link set lo up
|
|
|
|
ip link add veth-host type veth peer name veth-vpn
|
|
ip link set veth-vpn netns wg-mullvad-namespace
|
|
ip addr add 10.200.200.1/24 dev veth-host
|
|
ip netns exec wg-mullvad-namespace ip addr add 10.200.200.2/24 dev veth-vpn
|
|
ip link set veth-host up
|
|
ip netns exec wg-mullvad-namespace ip link set veth-vpn up
|
|
ip netns exec wg-mullvad-namespace ip route add default via 10.200.200.1
|
|
|
|
mkdir -p /etc/netns/wg-mullvad-namespace
|
|
echo "nameserver 10.128.0.1" > /etc/netns/wg-mullvad-namespace/resolv.conf
|
|
echo "nameserver fd7d:76ee:e68f:a993::1" >> /etc/netns/wg-mullvad-namespace/resolv.conf
|
|
'';
|
|
|
|
postShutdown = ''
|
|
ip netns del wg-mullvad-namespace
|
|
|
|
ip link del veth-host
|
|
'';
|
|
|
|
peers = [
|
|
{
|
|
publicKey = "PyLCXAQT8KkM4T+dUsOQfn+Ub3pGxfGlxkIApuig+hk=";
|
|
presharedKey = "YAbLXCB/uuKPfulaFAylvGbh3nuE881GupBZ/HBULpQ=";
|
|
allowedIPs = ["0.0.0.0/0" "::0/0"];
|
|
endpoint = "europe3.vpn.airdns.org:1637";
|
|
persistentKeepalive = 15;
|
|
}
|
|
];
|
|
};
|
|
};
|
|
}
|