alioth/nixpkgs
3
0
Fork 0
forked from mirrors/nixpkgs
Code Releases Activity

wireguard: add per-peer routing table option

Browse source 
This adds a convenient per-peer option to set the routing table that associated routes are added to. This functionality is very useful for isolating interfaces from the kernel's global routing and forcing all traffic of a virtual interface (or a group of processes, via e.g. "ip rule add uidrange 10000-10009 lookup 42") through Wireguard.
This commit is contained in:
evujumenuk 2017-08-04 18:30:53 +02:00 committed by GitHub
parent 53bd6cf417
commit e355f7044d
1 changed files with 15 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

19
nixos/modules/services/networking/wireguard.nix
View file

@ -160,6 +160,14 @@ let
interval of 25 seconds; however, most users will not need this.'';
};
table = mkOption {
default = "main";
type = types.str;
description = ''The kernel routing table to add this peer's associated
routes to. Setting this is useful for e.g. policy routing ("ip rule")
or virtual routing and forwarding ("ip vrf"). Both numeric table IDs
and table names (/etc/rt_tables) can be used. Defaults to "main".'';
};
};
};
@ -207,9 +215,11 @@ let
"${ipCommand} link set up dev ${name}"
(map (peer: (map (ip:
"${ipCommand} route replace ${ip} dev ${name}"
) peer.allowedIPs)) values.peers)
(map (peer:
(map (allowedIP:
"${ipCommand} route replace ${allowedIP} dev ${name} table ${peer.table}"
) peer.allowedIPs)
) values.peers)
values.postSetup
]);
@ -240,7 +250,8 @@ in
peers = [
{ allowedIPs = [ "192.168.20.1/32" ];
publicKey = "xTIBA5rboUvnH4htodjb6e697QjLERt1NAB4mZqp8Dg=";
endpoint = "demo.wireguard.io:12913"; }
endpoint = "demo.wireguard.io:12913";
table = "42"; }
];
};
};