WireGuard: Difference between revisions
add solutions for secure dns |
Include specifying the external interface in the proxy setup. |
||
| (5 intermediate revisions by 4 users not shown) | |||
| Line 18: | Line 18: | ||
systemd.network is recommended due to its powerful configuration interface. | systemd.network is recommended due to its powerful configuration interface. | ||
wg-quick is suitable for common usage patterns. networking.wireguard seems to | wg-quick is suitable for common usage patterns. networking.wireguard seems to | ||
have issues with routing. NetworkManager does not | have issues with routing. NetworkManager does not support Proxy server setup, and | ||
is cubersome to use. | is cubersome to use. | ||
| Line 167: | Line 167: | ||
ListenPort = 51820; | ListenPort = 51820; | ||
# ensure file is readable by `systemd-network` user | |||
PrivateKeyFile = config.age.secrets.wg-key-vps.path; | PrivateKeyFile = config.age.secrets.wg-key-vps.path; | ||
| Line 200: | Line 201: | ||
== Proxy server setup == | == Proxy server setup == | ||
To route your internet traffic through the server, first check the name of your active network interface. This can be done through running this command: | |||
<pre> | |||
ip route get 9.9.9.9 | |||
</pre> | |||
and the result should be something similar to: | |||
<pre> | |||
9.9.9.9 via 192.168.1.1 dev enp2s0 src 192.168.1.35 uid 0 | |||
</pre> | |||
The item after <code>dev</code> is your active interface, in this case <code>enp2s0</code>. | |||
After that, set up WireGuard the same way as the [[#Peer_setup|peer setup]], except do not include the <code>Endpoint</code> option. Then, add the following options to your configuration, using the active network interface you previously found for <code>externalInterface</code>: | |||
<syntaxhighlight lang="nix"> | <syntaxhighlight lang="nix"> | ||
| Line 208: | Line 218: | ||
enable = true; | enable = true; | ||
enableIPv6 = true; | enableIPv6 = true; | ||
externalInterface = " | externalInterface = "enp2s0"; | ||
internalInterfaces = [ "wg0" ]; | internalInterfaces = [ "wg0" ]; | ||
}; | }; | ||
| Line 294: | Line 304: | ||
FirewallMark = 42; | FirewallMark = 42; | ||
# we specify that the routing table 1000 must be used | # (... continued) we specify that the routing table 1000 must be used | ||
# (which is the wireguard routing table). This rule routes all traffic through wireguard. | # (which is the wireguard routing table). This rule routes all traffic through wireguard. | ||
# inside routingPolicyRules section is called Table, not RouteTable | # inside routingPolicyRules section is called Table, not RouteTable | ||
| Line 387: | Line 397: | ||
Family = "both"; | Family = "both"; | ||
} | } | ||
] | ]; | ||
# Configure port forwarding for Transmission under NAT | |||
networking.nat.forwardPorts = | |||
[ | |||
{ | |||
destination = "10.0.0.1:80"; | |||
proto = "tcp"; | |||
sourcePort = 8080; | |||
} | |||
{ | |||
destination = "[fc00::2]:80"; | |||
proto = "tcp"; | |||
sourcePort = 8080; | |||
} | |||
]; | |||
</syntaxhighlight> | </syntaxhighlight> | ||
| Line 546: | Line 570: | ||
== Reuse existing wg-quick config file == | == Reuse existing wg-quick config file == | ||
If you have WireGuard configuration files that you want to use as-is | If you have WireGuard configuration files that you want to use as-is (similarly how you would configure WireGuard e.g. in [https://wiki.debian.org/WireGuard#Step_2_-_Configuration Debian]), without converting them to a declarative NixOS configuration, you can also configure <code>wg-quick</code> to use them. For example, if you have a configuration file <code>/etc/nixos/wireguard/wg0.conf</code>, add the following line to your <code>configuration.nix</code>: | ||
(similarly how you would | |||
[https://wiki.debian.org/WireGuard#Step_2_-_Configuration | |||
NixOS configuration, you can also configure <code>wg-quick</code> to | |||
use them. For example, if you have a configuration file | |||
<code>/etc/nixos/wireguard/wg0.conf</code>, add the following line to | |||
your <code>configuration.nix</code>: | |||
<syntaxHighlight lang="nix"> | <syntaxHighlight lang="nix"> | ||