summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorKjetil Orbekk <kj@orbekk.com>2023-03-01 14:10:25 -0500
committerKjetil Orbekk <kj@orbekk.com>2023-03-01 14:10:25 -0500
commit1ff6fefe39521844872cb7aad165cf8ee9f6a1cc (patch)
tree180e99dd3810185ec512108adbc3362dd5aa7bdc
parent0c203461517244b40a576135c76e49f1fa23c2e2 (diff)
vpn setup
-rw-r--r--machines/dragon.nix6
-rw-r--r--modules/router.nix11
2 files changed, 11 insertions, 6 deletions
diff --git a/machines/dragon.nix b/machines/dragon.nix
index 9174c15..16ae1cf 100644
--- a/machines/dragon.nix
+++ b/machines/dragon.nix
@@ -50,10 +50,10 @@ in {
services.transmission = {
enable = true;
- openPeerPorts = true;
- openRPCPort = true;
settings.download-dir = "/storage/upload";
- settings.peer-port = 51413;
+ settings.peer-port = 55324;
+ settings.rpc-bind-address = "0.0.0.0";
+ settings.rpc-whitelist = "172.20.*.*";
};
systemd.services.transmission.serviceConfig.NetworkNamespacePath = "/var/run/netns/vpn";
# services.tailscale.enable = true;
diff --git a/modules/router.nix b/modules/router.nix
index 65b8ea7..9251229 100644
--- a/modules/router.nix
+++ b/modules/router.nix
@@ -147,8 +147,9 @@ let
dhcp-range=tag:vpnlan-vport,172.20.30.10,172.20.30.254,5m
dhcp-option=tag:vpnlan-vport,option:router,172.20.30.1
dhcp-option=tag:vpnlan-vport,option:dns-server,193.138.218.74
- dhcp-range=tag:vpnlan-vport,::2,::1000,constructor:vpnlan-vport,ra-only
+ dhcp-range=tag:vpnlan-vport,::2,::1000,constructor:vpnlan-vport,ra-only,5m
dhcp-host=id:00:04:33:32:31:37:37:31:58:4d:32:35:31:37:30:30:4a:44,tag:vpnlan-vport,[::2]
+ dhcp-host=id:vpn,tag:vpnlan-vport,172.20.30.2
'';
};
@@ -157,7 +158,6 @@ let
extraConfig = ''
noipv6rs
noipv6
- nohook resolv.conf
interface wan-vport
dhcp
'';
@@ -210,7 +210,7 @@ let
oifname wan-vport counter accept
oifname mullvad counter accept
- ip6 daddr 2001:470:8e2e:30::2 th dport 9091 counter accept;
+ ip daddr 172.20.30.2 th dport 9091 counter accept;
oifname servers-vport meta l4proto {tcp, udp} th dport $SERVER_WAN_PORTS counter accept
iifname lan-vport oifname servers-vport meta l4proto {tcp, udp} th dport $SERVER_LAN_PORTS counter accept
iifname servers-vport counter accept
@@ -233,6 +233,7 @@ let
chain prerouting {
type nat hook prerouting priority -100; policy accept
meta nfproto ipv4 iifname wan-vport tcp dport $SERVER_WAN_PORTS dnat to 172.20.20.2
+ meta nfproto ipv4 iifname vpn-vport tcp dport 55324 dnat to 172.20.30.2
}
chain postrouting {
type nat hook postrouting priority 100; policy accept
@@ -296,7 +297,11 @@ in {
privateNetwork = false;
config = { config, lib, pkgs, ... }: {
system.stateVersion = "22.11";
+ networking.firewall.enable = false;
networking.interfaces.vpn-vport.useDHCP = true;
+ networking.dhcpcd.extraConfig = ''
+ clientid vpn
+ '';
};
additionalCapabilities = ["CAP_NET_ADMIN"];
};