 | NixOS Networking | 911 Members |
| Declaratively manage your switching, routing, wireless, tunneling and more. | 268 Servers |
| NixOS Networking | 911 Members |
| Declaratively manage your switching, routing, wireless, tunneling and more. | 268 Servers |
| Sender | Message | Time |
|---|---|---|
| 24 Dec 2025 | ||
 Pratham Patel | At the moment, I have a very simple firewall rule for my router to ensure traffic between private and guest networks don't ever interfere. The configuration for that is here. Additionally, I have a helper function of sorts to create wireguard interfaces. Given I'm very new to firewall rules and routing, I'm not sure how to ensure that all traffic from the private network is routed via the wireguard interface but the guest network's traffic exits without ever touching the wireguard interface. Let's call it I believe that this setup will require the following additional rules to the And also require a new This is what I have come up with so far. Is there anything else that I'm missing, or doing wrong? | 08:57:37 |
| Pratham Patel | * At the moment, I have a very simple firewall rule for my router to ensure traffic between private and guest networks don't ever interfere. The configuration for that is here. Additionally, I have a helper function of sorts to create wireguard interfaces. Given I'm very new to firewall rules and routing, I'm not sure how to ensure that all traffic from the private network is routed via the wireguard interface but the guest network's traffic exits without ever touching the wireguard interface. Let's call it I believe that this setup will require the following additional rules to the And also require a new This is what I have come up with so far. Is there anything else that I'm missing, or doing wrong? (edit: switched git reference from master to a specific commit) | 09:02:24 |
| Pratham Patel | * At the moment, I have a very simple firewall rule for my router to ensure traffic between private and guest networks don't ever interfere. The configuration for that is here. Additionally, I have a helper function of sorts to create wireguard interfaces. Given I'm very new to firewall rules and routing, I'm not sure how to ensure that all traffic from the private network is routed via the wireguard interface but the guest network's traffic exits without ever touching the wireguard interface. Let's call it I believe that this setup will require the following additional rules to the And also require a new This is what I have come up with so far. Is there anything else that I'm missing, or doing wrong? (edit: switched git reference from master to a specific commit) | 09:02:49 |
| Pratham Patel | * At the moment, I have a very simple firewall rule for my router to ensure traffic between private and guest networks don't ever interfere. The configuration for that is here. Additionally, I have a helper function of sorts to create wireguard interfaces. Given I'm very new to firewall rules and routing, I'm not sure how to ensure that all traffic from the private network is routed via the wireguard interface but the guest network's traffic exits without ever touching the wireguard interface. Let's call it I believe that this setup will require the following additional rules to the And also require a new This is what I have come up with so far. Is there anything else that I'm missing, or doing wrong? (edit: switched git reference from master to a specific commit) | 09:04:06 |
 pltrz joined the room. | 12:41:07 | |
 @acidbong:envs.net | does systemd-resolved support secret configs? judging by man resolved.conf, it only accepts entries from systemd/resolved.conf[.d/*.conf] | 16:46:31 |
 Autiboy | You might be able to use agenix | 16:52:57 |
| @acidbong:envs.net | i already use sops-nix, how would it be different? | 16:54:13 |
| Autiboy | It shouldn't be that different | 16:56:29 |
| @acidbong:envs.net | but does resolved support configs from outside /etc/systemd? | 16:56:52 |
| Autiboy | I don't know. But if your trying to specify a secrets file in a unit you can use extraConfig | 16:59:05 |
 @marcel:envs.net | Sops also supports installing secrets so any location. Not just /run/secrets | 16:59:36 |
| @acidbong:envs.net | ah, TIL | 17:00:36 |
| @marcel:envs.net | * | 17:18:50 |
| @acidbong:envs.net | on a semi-related note, I want to use NextDNS without its client, which option of the listed ones (Resolved, Dnsmasq, Stubby, DNScrypt, Kresd, Cloudflared, Unbound) is the most convenient/fitting for a laptop-only setup? | 17:27:17 |
| @acidbong:envs.net | * on a semi-related note, I want to use NextDNS without its client, which option of the listed ones (Resolved, Dnsmasq, Stubby, DNScrypt, Kresd, Cloudflared, Unbound) is the most convenient/fitting for a laptop-only setup, with ot without considering NixOS? | 17:28:44 |
 K900 | resolved is definitely the least work | 17:33:35 |
| @acidbong:envs.net | and already integrates with NetworkManager | 17:34:25 |
| @acidbong:envs.net | (but so does Dnsmasq 🤔 ) | 17:34:40 |