nix/nixos/router.nix

406 lines
9.9 KiB
Nix
Raw Normal View History

2023-10-31 17:21:56 -05:00
{
lib,
# outputs,
# config,
2024-07-16 16:36:22 -05:00
pkgs,
2023-10-31 17:21:56 -05:00
...
}: let
# NOTE: I could turn this into a cool NixOS module?
# TODO: review https://francis.begyn.be/blog/nixos-home-router
2023-10-31 17:21:56 -05:00
ip = "192.168.0.1";
cidr = "${ip}/16";
2024-07-16 15:38:46 -05:00
netmask = "255.255.0.0"; # see cidr
dhcp_lease_space = {
2023-10-31 17:21:56 -05:00
min = "192.168.0.5";
max = "192.168.0.250";
};
wan_if = "wan0";
lan_if = "lan0";
hosts = {
dragon = {
identifier = "dragon";
host = "dragon";
2023-11-01 11:09:26 -05:00
ip = "192.168.0.10";
2023-10-31 17:21:56 -05:00
};
beefcake = {
identifier = "beefcake";
host = "beefcake";
ip = "192.168.0.9";
};
2023-10-31 17:21:56 -05:00
};
in {
2024-07-16 15:38:46 -05:00
imports = [
{
2024-07-16 16:27:15 -05:00
# hardware
2024-07-16 15:38:46 -05:00
boot = {
loader = {
efi.canTouchEfiVariables = true;
systemd-boot.enable = true;
};
initrd.availableKernelModules = ["xhci_pci"];
initrd.kernelModules = [];
kernelModules = ["kvm-intel"];
extraModulePackages = [];
};
2024-07-11 12:51:51 -05:00
2024-07-16 15:38:46 -05:00
nixpkgs.hostPlatform = "x86_64-linux";
powerManagement.cpuFreqGovernor = "performance";
hardware.cpu.intel.updateMicrocode = true;
}
];
2023-10-31 17:21:56 -05:00
boot = {
kernel = {
sysctl = {
"net.ipv4.conf.all.forwarding" = true;
"net.ipv6.conf.all.forwarding" = true;
2024-07-16 15:38:46 -05:00
# TODO: may want to disable this once it's working
# "net.ipv6.conf.all.accept_ra" = 0;
# "net.ipv6.conf.all.autoconf" = 0;
# "net.ipv6.conf.all.use_tempaddr" = 0;
2023-10-31 17:21:56 -05:00
"net.ipv6.conf.wan0.accept_ra" = 2;
2024-07-11 12:51:51 -05:00
"net.ipv6.conf.wan0.autoconf" = 1;
2023-10-31 17:21:56 -05:00
};
};
};
2024-07-16 16:27:15 -05:00
# services.fail2ban.enable = true;
2023-10-31 17:21:56 -05:00
services.radvd = {
2024-07-16 16:14:55 -05:00
enable = false;
2023-11-02 10:01:58 -05:00
# NOTE: this config is just the default arch linux config I think and may
2023-10-31 17:21:56 -05:00
# need tweaking? this is what I had on the arch linux router, though :shrug:
2024-07-16 15:38:46 -05:00
# config = ''
# interface lo
# {
# AdvSendAdvert on;
# MinRtrAdvInterval 3;
# MaxRtrAdvInterval 10;
# AdvDefaultPreference low;
# AdvHomeAgentFlag off;
# prefix 2001:db8:1:0::/64
# {
# AdvOnLink on;
# AdvAutonomous on;
# AdvRouterAddr off;
# };
# prefix 0:0:0:1234::/64
# {
# AdvOnLink on;
# AdvAutonomous on;
# AdvRouterAddr off;
# Base6to4Interface ppp0;
# AdvPreferredLifetime 120;
# AdvValidLifetime 300;
# };
# route 2001:db0:fff::/48
# {
# AdvRoutePreference high;
# AdvRouteLifetime 3600;
# };
# RDNSS 2001:db8::1 2001:db8::2
# {
# AdvRDNSSLifetime 30;
# };
# DNSSL branch.example.com example.com
# {
# AdvDNSSLLifetime 30;
# };
# };
# '';
2023-11-02 10:01:58 -05:00
};
2024-07-16 15:38:46 -05:00
# services.resolved = {
# enable = true;
# extraConfig = ''
# [Resolve]
# DNSStubListener=no
# '';
# };
2024-07-16 16:27:15 -05:00
services.dnsmasq = {
enable = false;
settings = {
# server endpoints
listen-address = "::1,127.0.0.1,${ip}";
port = "53";
# DNS cache entries
cache-size = "10000";
# local domain entries
local = "/lan/";
domain = "lan";
expand-hosts = true;
dhcp-authoritative = true;
conf-file = "/usr/share/dnsmasq/trust-anchors.conf";
dnssec = true;
except-interface = "${wan_if}";
interface = "${lan_if}";
enable-ra = true;
# dhcp-option = "121,${cidr},${ip}";
dhcp-range = [
"lan,${dhcp_lease_space.min},${dhcp_lease_space.max},${netmask},10m"
"tag:${lan_if},::1,constructor:${lan_if},ra-names,12h"
];
dhcp-host = [
"${hosts.dragon.host},${hosts.dragon.ip},12h"
"${hosts.beefcake.host},${hosts.beefcake.ip},12h"
];
# may need to go in /etc/hosts (networking.extraHosts), too?
address = [
"/video.lyte.dev/192.168.0.9"
"/git.lyte.dev/192.168.0.9"
"/bw.lyte.dev/192.168.0.9"
"/files.lyte.dev/192.168.0.9"
"/vpn.h.lyte.dev/192.168.0.9"
"/.h.lyte.dev/192.168.0.9"
];
server = [
"${ip}"
"8.8.8.8"
"8.8.4.4"
"1.1.1.1"
"1.0.0.1"
];
};
};
2023-10-31 17:21:56 -05:00
2024-07-16 16:36:22 -05:00
environment.systemPackages = with pkgs; [
wpa_supplicant
];
2024-07-16 10:48:32 -05:00
networking = {
hostName = "router";
domain = "h.lyte.dev";
2024-07-16 15:38:46 -05:00
useDHCP = false;
2024-07-16 16:36:22 -05:00
wireless.enable = true;
2024-07-16 10:48:32 -05:00
2024-07-16 15:38:46 -05:00
# useDHCP = true;
# nat.enable = true; # TODO: maybe replace some of the nftables stuff with this module?
2024-07-16 10:48:32 -05:00
extraHosts = ''
127.0.0.1 localhost
${ip} router.h.lyte.dev router
2023-10-31 17:21:56 -05:00
2024-07-16 10:48:32 -05:00
::1 localhost ip6-localhost ip6-loopback
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
'';
2023-11-02 10:01:58 -05:00
2024-07-16 16:36:22 -05:00
firewall.enable = true;
2024-07-16 16:27:15 -05:00
firewall.allowedTCPPorts = [
2201
22
];
2024-07-16 15:38:46 -05:00
2024-07-16 10:48:32 -05:00
nftables = {
2024-07-16 16:27:15 -05:00
enable = false;
2024-07-16 10:48:32 -05:00
flushRuleset = true;
tables = {
filter = {
family = "inet";
content = ''
chain input {
# type filter hook input priority filter; policy accept;
type filter hook input priority 0;
# anything from loopback interface
iifname "lo" accept
# accept traffic we originated
ct state { established, related } counter accept
ct state invalid counter drop
# ICMP
ip6 nexthdr icmpv6 icmpv6 type { echo-request, nd-neighbor-solicit, nd-neighbor-advert, nd-router-solicit, nd-router-advert, mld-listener-query, destination-unreachable, packet-too-big, time-exceeded, parameter-problem } counter accept
ip protocol icmp icmp type { echo-request, destination-unreachable, router-advertisement, time-exceeded, parameter-problem } counter accept
ip protocol icmpv6 counter accept
ip protocol icmp counter accept
meta l4proto ipv6-icmp counter accept
udp dport dhcpv6-client counter accept
tcp dport { 64022, 22, 53, 67, 25565 } counter accept
udp dport { 64020, 22, 53, 67 } counter accept
# iifname "iot" ip saddr $iot-ip tcp dport { llmnr } counter accept
# iifname "iot" ip saddr $iot-ip udp dport { mdns, llmnr } counter accept
iifname "${lan_if}" tcp dport { llmnr } counter accept
iifname "${lan_if}" udp dport { mdns, llmnr } counter accept
counter drop
}
# allow all outgoing
chain output {
type filter hook output priority 0;
accept
}
chain forward {
type filter hook forward priority 0;
accept
}
'';
};
nat = {
family = "ip";
content = ''
set masq_saddr {
type ipv4_addr
flags interval
elements = { ${cidr} }
}
map map_port_ipport {
type inet_proto . inet_service : ipv4_addr . inet_service
}
chain prerouting {
iifname ${lan_if} accept
type nat hook prerouting priority dstnat + 1; policy accept;
fib daddr type local dnat ip addr . port to meta l4proto . th dport map @map_port_ipport
iifname ${wan_if} tcp dport { 22, 80, 443, 25565, 64022 } dnat to ${hosts.beefcake.ip}
iifname ${wan_if} udp dport { 64020 } dnat to ${hosts.beefcake.ip}
# iifname ${wan_if} tcp dport { 25565 } dnat to 192.168.0.244
# iifname ${wan_if} udp dport { 25565 } dnat to 192.168.0.244
# router
iifname ${wan_if} tcp dport { 2201 } dnat to ${ip}
}
chain output {
type nat hook output priority -99; policy accept;
ip daddr != 127.0.0.0/8 oif "lo" dnat ip addr . port to meta l4proto . th dport map @map_port_ipport
}
chain postrouting {
type nat hook postrouting priority srcnat + 1; policy accept;
oifname ${lan_if} masquerade
ip saddr @masq_saddr masquerade
}
'';
};
};
};
2023-10-31 17:21:56 -05:00
2024-07-16 10:48:32 -05:00
dhcpcd = {
2024-07-16 16:27:15 -05:00
enable = false;
2024-07-16 10:48:32 -05:00
extraConfig = ''
duid
# No way.... https://github.com/NetworkConfiguration/dhcpcd/issues/36#issuecomment-954777644
# issues caused by guests with oneplus devices
noarp
persistent
vendorclassid
option domain_name_servers, domain_name, domain_search
option classless_static_routes
option interface_mtu
option host_name
#option ntp_servers
require dhcp_server_identifier
slaac private
noipv4ll
noipv6rs
static domain_name_servers=${ip}
interface ${wan_if}
gateway
ipv6rs
iaid 1
# option rapid_commit
# ia_na 1
ia_pd 1 ${lan_if}
interface ${lan_if}
static ip_address=${cidr}
static routers=${ip}
static domain_name_servers=${ip}
'';
};
2023-10-31 17:21:56 -05:00
};
2024-07-16 10:48:32 -05:00
systemd.services.systemd-networkd-wait-online.enable = lib.mkForce false;
2024-07-16 16:14:55 -05:00
services.openssh.listenAddresses = [
{
addr = "0.0.0.0";
port = 2201;
}
2024-07-16 16:27:15 -05:00
{
addr = "[::]";
port = 2201;
}
2024-07-16 16:14:55 -05:00
];
2023-11-02 10:01:58 -05:00
systemd.network = {
2023-10-31 17:21:56 -05:00
enable = true;
2024-07-16 16:36:22 -05:00
networks = {
wan = {
networkConfig = {
DHCP = "yes";
};
};
lan = {
networkConfig = {
DHCP = "yes";
};
};
};
2023-11-02 10:01:58 -05:00
links = {
2024-07-16 15:38:46 -05:00
"10-${wan_if}" = {
2023-11-02 10:01:58 -05:00
enable = true;
matchConfig = {
MACAddress = "00:01:2e:82:73:59";
};
linkConfig = {
Name = wan_if;
};
};
2024-07-16 15:38:46 -05:00
"10-${lan_if}" = {
2023-11-02 10:01:58 -05:00
enable = true;
matchConfig = {
MACAddress = "00:01:2e:82:73:5a";
};
linkConfig = {
Name = lan_if;
};
};
};
2023-10-31 17:21:56 -05:00
};
services.avahi = {
enable = true;
reflector = true;
2024-07-16 10:48:32 -05:00
allowInterfaces = [lan_if];
};
system.stateVersion = "24.05";
2023-10-31 17:21:56 -05:00
}