services: Add wireguard service

configuration/default.nix

@@ -53,6 +53,7 @@
   networking = {
     hostName = "tlaternet";
     usePredictableInterfaceNames = false;
+    useDHCP = false;
 
     firewall = {
       allowedTCPPorts = [

configuration/services/wireguard.nix

@@ -1,4 +1,9 @@
 {config, ...}: {
+  # iptables needs to permit forwarding from wg0 to wg0
+  networking.firewall.extraCommands = ''
+    iptables -A FORWARD -i wg0 -o wg0 -j ACCEPT
+  '';
+
   systemd.network = {
     netdevs = {
       "20-wg0" = {
@@ -38,11 +43,27 @@
       "20-wg0" = {
         matchConfig.Name = "wg0";
 
-        networkConfig.Address = [
-          "10.45.249.1/24"
+        networkConfig = {
+          Address = [
+            "10.45.249.1/32"
             # TODO(tlater): Add IPv6 whenever that becomes relevant
           ];
 
+          IPForward = "yes";
+          IPv4ProxyARP = "yes";
+        };
+
+        routes = [
+          {
+            routeConfig = {
+              Source = "10.45.249.0/24";
+              Destination = "10.45.249.0/24";
+              Gateway = "10.45.249.1";
+              GatewayOnLink = "no";
+            };
+          }
+        ];
+
         linkConfig.RequiredForOnline = "no";
       };
     };