From e5f231d420bc6688e7c6f080401ee81a7a9664b7 Mon Sep 17 00:00:00 2001
From: Collin Williams <96917990+bluedragon1221@users.noreply.github.com>
Date: Sun, 23 Aug 2026 16:11:16 -0500
Subject: configure udp2raw for wireguard

some public wifi networks don't let you initiate connections to remote
udp ports. but what about a tcp port?
---
 hosts/ganymede/wireguard.nix | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

(limited to 'hosts/ganymede/wireguard.nix')

diff --git a/hosts/ganymede/wireguard.nix b/hosts/ganymede/wireguard.nix
index 27d50bb..6e6ae05 100644
--- a/hosts/ganymede/wireguard.nix
+++ b/hosts/ganymede/wireguard.nix
@@ -11,15 +11,31 @@
 
   networking.firewall = {
     allowedUDPPorts = [51820];
+    allowedTCPPorts = [51843];
 
     trustedInterfaces = ["wg0"];
   };
 
+  systemd.services.udp2raw-server = {
+    description = "udp2raw WireGuard transport";
+
+    wantedBy = ["multi-user.target"];
+    after = ["network-online.target"];
+    wants = ["network-online.target"];
+
+    serviceConfig = {
+      ExecStart = "${lib.getExe pkgs.udp2raw} -s -l 0.0.0.0:51843 -r 127.0.0.1:51820 -k shared-secret -a";
+
+      Restart = "on-failure";
+      RestartSec = "2s";
+    };
+  };
+
   systemd.network.netdevs."50-wg0" = {
     netdevConfig = {
       Kind = "wireguard";
       Name = "wg0";
-      MTUBytes = 1200;
+      MTUBytes = "1200";
     };
 
     wireguardConfig = {
-- 
cgit v1.3.1