Title: How to setup wireguard on NixOS

	Title: How to setup wireguard on NixOS
	Author: Solène
	Date: 18 May 2021
	Tags: nixos networking
	Description:

	# Introduction

	Today I will share my simple wireguard setup using NixOS as a wireguard
	server. The official documentation is actually very good but it didn't
	really fit for my use case. I have a server with multiples services
	but some of them need to be only reachable through wireguard, but I
	don't want to open all ports to wireguard either.

	As a quick introduction to Wireguard, it's an UDP based VPN protocol
	with the specificity that it's stateless, meaning it doesn't huge any
	bandwidth when not in use and doesn't rely on your IP either. If you
	switch from an IP to another to connect to the other wireguard peer, it
	will be seamless in regards to wireguard.

	NixOS wireguard documentation

	# Wireguard setup

	The setup is actually easy if you use the program "wireguard" to
	generate the keys. You can use "nix-shell -p wireguard" to run the
	following commands:

	```shell commands
	umask 077 # this is so to make files only readable by root
	wg genkey > /root/wg-private
	wg pubkey < /root/wg-private > /root/wg-public
	```

	Congratulations, you generated a wireguard private key in
	/root/wg-private and a wireguard public key in /root/wg-public, as
	usual, you can share the public key with other peers but the private
	key must be kept secret on this machine.

	Now, edit your /etc/nixos/configuration.nix file, we will create a
	network 192.168.100.0/24 in which the wireguard server will be
	192.168.100.1 and a laptop peer will be 192.168.100.2, the wireguard
	UDP port chosen is 5553.

	```NixOS configuration file sample
	networking.wireguard.interfaces = {
	wg0 = {
	ips = [ "192.168.100.1/24" ];
	listenPort = 5553;
	privateKeyFile = "/root/wg-private";
	peers = [
	{ # laptop
	publicKey = "uPfe4VBmYjnKaaqdDT1A2PMFldUQUreqGz6v2VWjwXA=";
	allowedIPs = [ "192.168.100.2/32" ];
	}];
	};
	};
	```

	# Firewall configuration

	Now, you will also want to enable your firewall and make the UDP port
	5553 opened on your ethernet device (eth0 here). On the wireguard
	tunnel, we will only allow TCP port 993.

	```NixOS configuration file sample
	networking.firewall.enable = true;

	networking.firewall.interfaces.eth0.allowedTCPPorts = [ 22 25 465 587 ];
	networking.firewall.interfaces.eth0.allowedUDPPorts = [ 5553 ];

	networking.firewall.interfaces.wg0.allowedTCPPorts = [ 993 ];
	```

	Specifically defining the firewall rules for eth0 are not useful if you
	want to allow the same ports on wireguard (+ some other ports specifics
	to wg0) or if you want to set the wg0 interface entirely trusted (no
	firewall applied).

	# Building

	When you have done all the changes, run "nixos-rebuild switch" to apply
	the changes, you will see a new network interface wg0.

	# Conclusion

	I obviously stripped down my real world use case but if for some
	reasons you want a wireguard tunnel stricter than what's available on
	the public network interfaces rules, this is how you do.