Add WireGuard tunnels as firewall zone members

router.wireguard.<name> configures tunnels through networkd: road warrior
(listening, dual-stack), site-to-site (no transfer network) and provider
dial-out with masquerade. A tunnel has a zone like a LAN, so inter-zone rules
apply; management, DNS and internet are opt-in. Peers' allowedIPs become
routes (destination-based routing; default-route tunnels are rejected).

Tunnels have a kill switch (default on): forwarded packets for their
allowedIPs are dropped if they would leave via an uplink, before the
established-accept so flows that used the tunnel are cut too.

Private keys stay outside the Nix store and are passed to the unprivileged
systemd-networkd with LoadCredential, so key files can be root-only.

Assertions cover CIDR/key/endpoint formats, duplicate allowedIPs, overlaps
with LAN subnets, port and device clashes, and rule destinations inside
tunnel networks. A five-VM `wireguard` check covers road warrior, site-to-site,
the provider tunnel with an IPv6 transfer net, zone rules and the kill switch.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

This commit is contained in:

nils

2026-10-27 19:56:45 +01:00

co-authored by

Claude Sonnet 5.5

parent 6015ee2e6d

commit 30ab1a0ed6

11 changed files with 975 additions and 26 deletions

									
										modules/router/default.nix
									
		+1
		
												View File
												
				@@ -4,6 +4,7 @@

				    ./assertions.nix

				    ./networking.nix

				    ./pppoe.nix

				    ./wireguard.nix

				    ./firewall.nix

				    ./dhcp.nix

				    ./dns.nix