jalr/weinturm-infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Use tunnel as gateway for VoIP traffic

Browse source
This commit is contained in:
Jakob Lechner 2025-07-24 03:44:00 +02:00
parent 4193e6b96a
commit bcacdc6609
2 changed files with 64 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

2
hosts/pbx/networking.nix
View file

@ -9,7 +9,7 @@
useDHCP = false; useDHCP = false;
# Fix Intel NIC e1000e hardware unit hang # Fix Intel NIC e1000e hardware unit hang
localCommands = "${pkgs.ethtool}/bin/ethtool -K enp0s25 tso off gso off"; localCommands = lib.mkBefore "${pkgs.ethtool}/bin/ethtool -K enp0s25 tso off gso off";
firewall.interfaces = { firewall.interfaces = {
weinturm.allowedUDPPorts = [53 67]; weinturm.allowedUDPPorts = [53 67];

72
hosts/pbx/services/public-ip4-tunnel.nix
View file

@ -1,5 +1,6 @@
{ {
config, config,
lib,
pkgs, pkgs,
... ...
}: let }: let
@ -17,6 +18,16 @@ in {
sopsFile = ../secrets.yaml; sopsFile = ../secrets.yaml;
}; };
services.yate.config.ysipchan = {
general.localaddress = externalIp;
"listener external" = {
enable = "true";
type = "udp";
addr = externalIp;
port = 5060;
};
};
networking = { networking = {
iproute2 = { iproute2 = {
enable = true; enable = true;
@ -24,18 +35,61 @@ in {
${toString rtTable.id} ${rtTable.name} ${toString rtTable.id} ${rtTable.name}
''; '';
}; };
wireguard.interfaces."${interface}" = {
wireguard.interfaces."${interface}" = let
rules = [
"from 192.168.98.0/24 to 10.0.0.0/8 table main priority 10"
"from 192.168.98.0/24 to 192.168.0.0/16 table main priority 10"
"fwmark 0x1 to 192.168.0.0/16 table main priority 10"
"fwmark 0x1 to 10.0.0.0/8 table main priority 10"
"from ${externalIp} to 10.0.0.0/8 table main priority 10"
"from ${externalIp} to 192.168.0.0/16 table main priority 10"
"from ${externalIp} table ${rtTable.name} priority 20"
"from 192.168.98.0/24 table ${interface} priority 20"
"fwmark 0x1 table ${interface} priority 20"
];
addRule = rule: "ip rule add " + rule;
deleteRule = rule: "ip rule delete " + rule;
path = pkgs.lib.makeBinPath [pkgs.iproute2 pkgs.nftables];
in {
ips = ["${externalIp}/32"]; ips = ["${externalIp}/32"];
privateKeyFile = config.sops.secrets."wireguard/${interface}".path; privateKeyFile = config.sops.secrets."wireguard/${interface}".path;
table = rtTable.name; table = rtTable.name;
postSetup = '' postSetup = lib.concatLines [
${pkgs.iproute2}/bin/ip rule add from ${externalIp} to 192.168.0.0/16 table main priority 10 "export PATH=${path}"
${pkgs.iproute2}/bin/ip rule add from ${externalIp} table ${rtTable.name} priority 20 "set -x"
''; (lib.concatMapStringsSep "\n" addRule rules)
postShutdown = '' /*
${pkgs.iproute2}/bin/ip rule del from ${externalIp} to 192.168.0.0/16 table main priority 10 ip route change default dev ${interface} src ${externalIp} table ${rtTable.name}
${pkgs.iproute2}/bin/ip rule del from ${externalIp} table ${rtTable.name} priority 20 */
''; ''
nft add table ip wg_nat-${interface}
nft add chain ip wg_nat-${interface} postrouting '{type nat hook postrouting priority srcnat;}'
nft add rule ip wg_nat-${interface} postrouting ip saddr 192.168.0.0/16 oifname "public-ip4" counter snat to ${externalIp}
nft add table inet wg_filter-${interface}
nft add chain inet wg_filter-${interface} forward '{type filter hook forward priority 0; policy accept;}'
nft add table inet marks-${interface}
nft add chain inet marks-${interface} output '{type route hook output priority mangle;}'
nft add rule inet marks-${interface} output meta skuid yate mark set 0x1
''
];
postShutdown = lib.concatLines [
"export PATH=${path}"
"set -x"
(lib.concatMapStringsSep "\n" deleteRule rules)
''
nft delete table ip wg_nat-${interface}
nft delete table inet wg_filter-${interface}
nft delete table inet marks-${interface}
''
];
peers = [ peers = [
{ {
inherit publicKey; inherit publicKey;