{ config, lib, ... }: { options = { crony.wireguard.enable = lib.mkEnableOption "Open ports in firewall for wireguard to work."; }; config = lib.mkIf config.crony.wireguard.enable { # Allow for wireguard traffic networking.firewall = { # if packets are still dropped, they will show up in dmesg logReversePathDrops = true; # wireguard trips rpfilter up extraCommands = '' ip46tables -t mangle -I nixos-fw-rpfilter -p udp -m udp --sport 51820 -j RETURN ip46tables -t mangle -I nixos-fw-rpfilter -p udp -m udp --dport 51820 -j RETURN ''; extraStopCommands = '' ip46tables -t mangle -D nixos-fw-rpfilter -p udp -m udp --sport 51820 -j RETURN || true ip46tables -t mangle -D nixos-fw-rpfilter -p udp -m udp --dport 51820 -j RETURN || true ''; }; }; }