guixsd-config

commit 893f758249a3bbf9e7cd2e1f1a60676e18bbc583
parent d9c6b9a16dcf90beaa1fab92eb094855a8dda887
Author: Vineet Kumar <git@vineetk.net>
Date:   Thu,  1 Jan 2026 19:23:55 -0500

epistemia: fix vpn firewall and routing

Diffstat:
M
epistemia/systems/demiurge.scm
 | 
53
++++++++++++++++++++++++++++++++++++++++++-----------

1 file changed, 42 insertions(+), 11 deletions(-)
diff --git a/epistemia/systems/demiurge.scm b/epistemia/systems/demiurge.scm
@@ -4,12 +4,14 @@
   #:use-module (gnu packages golang-crypto)
   #:use-module (gnu packages linux)
   #:use-module (gnu packages version-control)
+  #:use-module (gnu packages vpn)
   #:use-module (gnu services desktop)
   #:use-module (gnu services dns)
   #:use-module (gnu services linux)
   #:use-module (gnu services networking)
   #:use-module (gnu services shepherd)
   #:use-module (gnu services ssh)
+  #:use-module (gnu services sysctl)
   #:use-module (gnu services vpn)
   #:use-module (gnu services web)
   #:use-module (gnu system accounts)
@@ -180,7 +182,21 @@ rpz:
 						     #$(file-append age "/bin/age -d -i /data/ssh/id_ed25519")
 						     " /data/src/public/guixsd-config/epistemia/secrets/wg0_demiurge.age)"))
 				   (pre-up '("ip route replace 45.134.142.206 via 192.168.1.1 dev eth0"))
-				   (post-down '("ip route del 45.134.142.206 via 192.168.1.1 dev eth0"))
+				   (post-up
+				    (list "ip rule add fwmark 0x1 table 100 priority 100"
+					  "ip rule add fwmark 51820 table 100 priority 100"
+					  "ip route add default via 192.168.1.1 dev eth0 table 100"
+					  #~(string-append #$(file-append iptables "/sbin/iptables") " -t mangle -A PREROUTING -i eth0 -d 192.168.1.2 -m conntrack --ctstate NEW -j CONNMARK --set-mark 0x1")
+					  #~(string-append #$(file-append iptables "/sbin/iptables") " -t mangle -A PREROUTING -i eth0 -j CONNMARK --restore-mark")
+					  #~(string-append #$(file-append iptables "/sbin/iptables") " -t mangle -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j CONNMARK --restore-mark")))
+				   (post-down
+				    (list "ip route del 45.134.142.206 via 192.168.1.1 dev eth0"
+					  "ip rule del fwmark 0x1 table 100"
+					  "ip rule del fwmark 51820 table 100"
+					  "ip route flush table 100"
+					  #~(string-append #$(file-append iptables "/sbin/iptables") " -t mangle -D PREROUTING -i eth0 -d 192.168.1.2 -m conntrack --ctstate NEW -j CONNMARK --set-mark 0x1")
+					  #~(string-append #$(file-append iptables "/sbin/iptables") " -t mangle -D PREROUTING -i eth0 -j CONNMARK --restore-mark")
+					  #~(string-append #$(file-append iptables "/sbin/iptables") " -t mangle -D OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j CONNMARK --restore-mark")))
 				   (peers
 				    (list
 				     (wireguard-peer
@@ -216,10 +232,17 @@ rpz:
 				          #~(string-append #$(file-append iptables "/sbin/ip6tables") " -I FORWARD 1 -j WG1-FWD")
 				          #~(string-append #$(file-append iptables "/sbin/ip6tables") " -A WG1-FWD -i wg1 -o wg1 -j ACCEPT")
 				          #~(string-append #$(file-append iptables "/sbin/ip6tables") " -A WG1-FWD -i wg1 -o wg0 -j ACCEPT")
-				          #~(string-append #$(file-append iptables "/sbin/ip6tables") " -A WG1-FWD -i wg0 -o wg1 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT")))
+				          #~(string-append #$(file-append iptables "/sbin/ip6tables") " -A WG1-FWD -i wg0 -o wg1 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT")
+
+					  ;; force saklas endpoint through wg0 (Mullvad); I can't connect otherwise
+					  "ip rule add to 157.180.125.215/32 lookup 51820 priority 50"
+
+					  ;; Set fwmark on wg1 interface to bypass wg0 (Mullvad)
+					  #~(string-append #$(file-append wireguard-tools "/bin/wg") " set wg1 fwmark 51820")))
 				   (pre-down
 				    ;; IPv4 and IPv6 NAT
-				    (list #~(string-append #$(file-append iptables "/sbin/iptables") " -t nat -D POSTROUTING -s 10.0.13.4/32 -o wg0 -j MASQUERADE")
+				    (list "ip rule del to 157.180.125.215/32 lookup 51820"
+					  #~(string-append #$(file-append iptables "/sbin/iptables") " -t nat -D POSTROUTING -s 10.0.13.4/32 -o wg0 -j MASQUERADE")
 				          #~(string-append #$(file-append iptables "/sbin/ip6tables") " -t nat -D POSTROUTING -s fd00:b0ba:cafe:babe::4/128 -o wg0 -j MASQUERADE")
 
 				          ;; IPv4 Forwarding Chain
@@ -263,11 +286,19 @@ rpz:
 				     (nginx-reverse-proxy "navidrome.demiurge.epistemia" 4533)
 				     (nginx-reverse-proxy "sdui.demiurge.epistemia" 5000))))))
 				    %base-services)
-			    (guix-service-type config => (guix-configuration
-							  (inherit config)
-							  (substitute-urls
-							   (append '("https://guix.bordeaux.inria.fr")
-								   %default-substitute-urls))
-							  (authorized-keys
-							   (append (list (local-file "../../inria.pub"))
-								   %default-authorized-guix-keys)))))))
+			    (guix-service-type config =>
+					       (guix-configuration
+						(inherit config)
+						(substitute-urls
+						 (append '("https://guix.bordeaux.inria.fr")
+							 %default-substitute-urls))
+						(authorized-keys
+						 (append (list (local-file "../../inria.pub"))
+							 %default-authorized-guix-keys))))
+			    (sysctl-service-type config =>
+						 (sysctl-configuration
+						  (settings
+						   (append
+						    '(("net.ipv4.ip_forward" . "1")
+						      ("net.ipv6.conf.all.forwarding" . "1"))
+						    %default-sysctl-settings)))))))