nixos

commit f89307bb3eccc312b23c746842895c4a1cca3b3a
parent 50ac60b2a6d116428d265581658fc841dfdd4e48
Author: MTRNord <mtrnord1@gmail.com>
Date:   Fri, 27 Oct 2023 21:20:22 +0200

Some helper rules

Diffstat:
M
nixos/worker-1/configuration.nix
 | 
12
++++++++++++
M
nixos/worker-2/configuration.nix
 | 
12
++++++++++++

2 files changed, 24 insertions(+), 0 deletions(-)
diff --git a/nixos/worker-1/configuration.nix b/nixos/worker-1/configuration.nix
@@ -170,6 +170,12 @@
         listenPort = 51820;
         privateKeyFile = config.sops.secrets."wireguard/worker-1/wg0/private_key".path;
         table = "off";
+        preUp = ''
+          iptables -t mangle -A FORWARD -o wg0 -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
+        '';
+        postUp = ''
+          iptables -t mangle -A FORWARD -o wg0 -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
+        '';
 
         peers = [
           # big one
@@ -189,6 +195,12 @@
         listenPort = 51821;
         privateKeyFile = config.sops.secrets."wireguard/worker-1/wg1/private_key".path;
         table = "off";
+        preUp = ''
+          iptables -t mangle -A FORWARD -o wg1 -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
+        '';
+        postUp = ''
+          iptables -t mangle -A FORWARD -o wg1 -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
+        '';
 
         peers = [
           # worker-2
diff --git a/nixos/worker-2/configuration.nix b/nixos/worker-2/configuration.nix
@@ -162,6 +162,12 @@ in
         listenPort = 51820;
         privateKeyFile = config.sops.secrets."wireguard/worker-2/wg0/private_key".path;
         table = "off";
+        preUp = ''
+          iptables -t mangle -A FORWARD -o wg0 -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
+        '';
+        postUp = ''
+          iptables -t mangle -A FORWARD -o wg0 -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
+        '';
 
         peers = [
           # big one
@@ -181,6 +187,12 @@ in
         listenPort = 51821;
         privateKeyFile = config.sops.secrets."wireguard/worker-2/wg1/private_key".path;
         table = "off";
+        preUp = ''
+          iptables -t mangle -A FORWARD -o wg1 -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
+        '';
+        postUp = ''
+          iptables -t mangle -A FORWARD -o wg1 -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
+        '';
 
         peers = [
           # worker-1