From 9ff883faef5d22180df873ac71568ea4f48d87dd Mon Sep 17 00:00:00 2001
From: Isabella Bastaja <isabella@sorre.xyz>
Date: Sat, 30 May 2026 12:18:16 +0200
Subject: wg: fix mdns

---
 wireguard.nix | 41 +++++++++++++++++++++++++++++++++++++++--
 1 file changed, 39 insertions(+), 2 deletions(-)

(limited to 'wireguard.nix')

diff --git a/wireguard.nix b/wireguard.nix
index 58c447e..d36d8f3 100644
--- a/wireguard.nix
+++ b/wireguard.nix
@@ -46,14 +46,39 @@ in
     format = "binary";
   };
 
-  networking.firewall.allowedUDPPorts = [ wgPort ];
+  networking = {
+    firewall.allowedUDPPorts = [ wgPort ];
 
+    nftables = {
+      enable = true;
+      tables.wg-mdns = {
+        enable = true;
+        family = "inet";
+        content = ''
+          # chain prerouting {
+          #   type filter hook prerouting priority mangle;
+          #   iifname "wg0" meta mark set ${toString firewallMark}
+          # }
+
+          chain input {
+            type filter hook input priority filter;
+
+            # Allow mDNS only over wireguard
+            # udp dport 5353 meta mark ${toString firewallMark} accept
+            udp dport 5353 accept
+          }
+        '';
+      };
+    };
+  };
+
+  services.resolved.settings.Resolve.MulticastDNS = false;
   systemd.network = {
     enable = true;
+
     networks."50-wg" = {
       matchConfig.Name = "wg0";
       address = [ conf.address ];
-      networkConfig.MulticastDNS = true;
     };
 
     netdevs."50-wg" = {
@@ -76,4 +101,16 @@ in
       wireguardPeers = generatePeers hostname;
     };
   };
+
+  services.avahi = {
+    enable = true;
+    nssmdns6 = true;
+    reflector = true;
+    allowInterfaces = [ "wg0" ];
+    publish = {
+      enable = true;
+      addresses = true;
+      workstation = true;
+    };
+  };
 }
-- 
cgit v1.3.1