# WireGuard CT (LXC 110, 10.48.200.67) NordVPN tunnel config
# Connects to NordVPN server at 2.56.190.66:51820 (Clouvider UK)
# Policy routes 10.200.0.0/24 (MediaStack tunnel clients) through NordVPN
# File: /etc/wireguard/nord0.conf

[Interface]
PrivateKey = Ebk+g1cMK14ured/u+QLvHPYxmoh9dCmeq65qbS/Aqg=
Address = 10.5.0.2/32
Table = off
PostUp = sysctl -w net.ipv4.conf.all.rp_filter=0 || true; ip route add default dev nord0 table 201 || true; ip rule add from 10.200.0.0/24 lookup 201 prio 100 || true; iptables -t nat -A POSTROUTING -o nord0 -j MASQUERADE || true
PostDown = ip route del default dev nord0 table 201 2>/dev/null; ip rule del from 10.200.0.0/24 lookup 201 2>/dev/null; iptables -t nat -D POSTROUTING -o nord0 -j MASQUERADE 2>/dev/null

[Peer]
PublicKey = 8pRFH/FfMBs3eBJCM2ABFoOs/13n78LYQvoovZVLdgI=
Endpoint = 2.56.190.66:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25