{
  config,
  pkgs,
  lib,
  ...
}: {
  networking = {
    interfaces.enp0s31f6 = {
      mtu = 1200;
      useDHCP = true;
    };
    networkmanager = {
      enable = true;
      wifi.macAddress = "random";
    };
    firewall = {
      enable = true;
      # if your minecraft server is not worky
      # this is probably why
      # Steam Remote UDP ports 27031 and 27036 and TCP ports 27036 and 27037
      allowedTCPPorts = [443 80 22 7000 8080 5432 27036 27037 9122];
      allowedUDPPorts = [443 80 44857 8080 27031 51820];
      allowPing = true;
      logReversePathDrops = true;
    };
    # nameservers = ["10.8.0.1"];
  };
  environment.etc = {
    "resolv.conf".text = ''
      options timeout:1
      nameserver 192.168.1.1
    '';
  };

  # slows down boot time
  systemd.services.NetworkManager-wait-online.enable = false;

  services.openvpn.servers = {
    remote = { config = ''config ${config.users.users.muon.home}/documents/openvpn/muon.ovpn''; };
  };

  # services.openssh = {
  #   enable = true;
  #   ports = [9122];
  # };

  # # Enable WireGuard
  # networking.wireguard.interfaces = {
  #   # "wg0" is the network interface name. You can name the interface arbitrarily.
  #   wg0 = {
  #     # Determines the IP address and subnet of the client's end of the tunnel interface.
  #     ips = [ "10.10.10.2/24" ];
  #     listenPort = 51820; # to match firewall allowedUDPPorts (without this wg uses random port numbers)

  #     # Path to the private key file.
  #     #
  #     # Note: The private key can also be included inline via the privateKey option,
  #     # but this makes the private key world-readable; thus, using privateKeyFile is
  #     # recommended.
  #     privateKeyFile = ''${config.users.users.muon.home}/documents/wireguard/vpn-client-private.key'';

  #     peers = [
  #       # For a client configuration, one peer entry for the server will suffice.

  #       {
  #         # Public key of the server (not a file path).
  #         publicKey = "iBuHEKkNftQHXHJbj1wJS2D/PwXHkldvkdQQCPsCRH0=";

  #         # Forward all the traffic via VPN.
  #         allowedIPs = [ "0.0.0.0/0" ];
  #         # Or forward only particular subnets
  #         #allowedIPs = [ "10.100.0.1" "91.108.12.0/22" ];

  #         # Set this to the server IP and port.
  #         endpoint = "93.95.230.11:51820"; # ToDo: route to endpoint not automatically configured https://wiki.archlinux.org/index.php/WireGuard#Loop_routing https://discourse.nixos.org/t/solved-minimal-firewall-setup-for-wireguard-client/7577

  #         # Send keepalives every 25 seconds. Important to keep NAT tables alive.
  #         persistentKeepalive = 25;
  #       }
  #     ];
  #   };
  # };
}