nix/nixos/router.nix

729 lines
21 KiB
Nix
Raw Normal View History

2023-10-31 17:21:56 -05:00
{
lib,
# outputs,
# config,
2024-07-16 16:36:22 -05:00
pkgs,
2023-10-31 17:21:56 -05:00
...
}: let
2024-07-18 10:01:56 -05:00
# NOTE: My goal is to be able to apply most of the common tweaks to the router
# either live on the system for ad-hoc changes (such as forwarding a port for a
# multiplayer game) or to tweak these values just below without reaching deeper
# into the modules' implementation of these configuration values
# NOTE: I could turn this into a cool NixOS module?
# TODO: review https://francis.begyn.be/blog/nixos-home-router
2024-07-16 20:34:02 -05:00
# TODO: more recent: https://github.com/ghostbuster91/blogposts/blob/a2374f0039f8cdf4faddeaaa0347661ffc2ec7cf/router2023-part2/main.md
hostname = "router";
domain = "h.lyte.dev";
2023-10-31 17:21:56 -05:00
ip = "192.168.0.1";
cidr = "${ip}/16";
2024-07-17 14:18:35 -05:00
netmask = "255.255.255.0"; # see cidr
2024-07-16 15:38:46 -05:00
dhcp_lease_space = {
2024-07-17 14:18:35 -05:00
min = "192.168.0.30";
2023-10-31 17:21:56 -05:00
max = "192.168.0.250";
};
2024-07-16 20:34:02 -05:00
interfaces = {
wan = {
2024-07-17 15:08:24 -05:00
name = "wan";
2024-07-16 20:34:02 -05:00
mac = "00:01:2e:82:73:59";
};
lan = {
2024-07-17 15:08:24 -05:00
name = "lan";
2024-07-16 20:34:02 -05:00
mac = "00:01:2e:82:73:5a";
};
};
2023-10-31 17:21:56 -05:00
hosts = {
dragon = {
2023-11-01 11:09:26 -05:00
ip = "192.168.0.10";
2023-10-31 17:21:56 -05:00
};
2024-07-19 12:15:39 -05:00
bald = {
ip = "192.168.0.11";
additionalHosts = [
"ourcraft.lyte.dev"
];
};
beefcake = {
ip = "192.168.0.9";
2024-07-17 16:27:54 -05:00
additionalHosts = [
2024-07-18 15:54:50 -05:00
".beefcake.lan"
2024-07-17 16:27:54 -05:00
"nix.h.lyte.dev"
2024-08-05 20:42:50 -05:00
"idm.h.lyte.dev"
2024-07-17 16:27:54 -05:00
"git.lyte.dev"
"video.lyte.dev"
2024-08-13 14:35:09 -05:00
"audio.lyte.dev"
"a.lyte.dev"
2024-07-17 16:27:54 -05:00
"bw.lyte.dev"
"files.lyte.dev"
"vpn.h.lyte.dev"
2024-07-26 11:30:05 -05:00
"atuin.h.lyte.dev"
"a.lyte.dev"
2024-07-17 16:27:54 -05:00
];
};
2023-10-31 17:21:56 -05:00
};
2024-07-16 20:34:02 -05:00
sysctl-entries = {
"net.ipv4.conf.all.forwarding" = true;
"net.ipv6.conf.all.forwarding" = true;
2024-07-17 16:27:54 -05:00
"net.ipv4.conf.default.rp_filter" = 1;
"net.ipv4.conf.${interfaces.wan.name}.rp_filter" = 1;
"net.ipv4.conf.${interfaces.lan.name}.rp_filter" = 0;
"net.ipv6.conf.${interfaces.wan.name}.accept_ra" = 2;
"net.ipv6.conf.${interfaces.wan.name}.autoconf" = 1;
2024-07-18 15:54:50 -05:00
"net.ipv6.conf.all.use_tempaddr" = 2;
"net.ipv6.conf.default.use_tempaddr" = lib.mkForce 2;
"net.ipv6.conf.${interfaces.wan.name}.use_tempaddr" = 2;
# "net.ipv6.conf.${interfaces.wan.name}.addr_gen_mode" = 2;
2024-07-16 20:34:02 -05:00
};
2023-10-31 17:21:56 -05:00
in {
2024-07-16 15:38:46 -05:00
imports = [
{
2024-07-16 16:27:15 -05:00
# hardware
2024-07-16 15:38:46 -05:00
boot = {
loader = {
efi.canTouchEfiVariables = true;
systemd-boot.enable = true;
};
initrd.availableKernelModules = ["xhci_pci"];
initrd.kernelModules = [];
kernelModules = ["kvm-intel"];
extraModulePackages = [];
};
2024-07-11 12:51:51 -05:00
2024-07-16 15:38:46 -05:00
nixpkgs.hostPlatform = "x86_64-linux";
powerManagement.cpuFreqGovernor = "performance";
hardware.cpu.intel.updateMicrocode = true;
}
];
2023-10-31 17:21:56 -05:00
2024-09-09 10:05:23 -05:00
environment.systemPackages = with pkgs; [
iftop
];
2024-07-18 15:54:50 -05:00
boot.kernel.sysctl =
sysctl-entries
// {
};
2024-07-16 20:34:02 -05:00
networking = {
hostName = hostname;
domain = domain;
2024-07-17 14:18:35 -05:00
2024-07-18 10:01:56 -05:00
# disable some of the sane defaults
2024-07-16 20:34:02 -05:00
useDHCP = false;
2024-07-17 14:18:35 -05:00
firewall.enable = false;
2024-07-18 10:01:56 -05:00
# use systemd.network for network interface configuration
2024-07-17 14:18:35 -05:00
useNetworkd = true;
2024-07-16 20:34:02 -05:00
# maybe we need this?
nat.enable = true;
2024-07-16 20:34:02 -05:00
extraHosts = ''
2024-07-17 14:18:35 -05:00
127.0.0.1 localhost
127.0.0.2 ${hostname}.${domain} ${hostname}
${ip} ${hostname}.${domain} ${hostname}
2024-07-17 14:18:35 -05:00
::1 localhost ip6-localhost ip6-loopback
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
2024-07-16 20:34:02 -05:00
'';
2024-07-18 10:01:56 -05:00
# the main meat and potatoes for most routers, the firewall configuration
# TODO: IPv6
2024-07-17 15:08:24 -05:00
nftables = let
inf = {
lan = interfaces.lan.name;
wan = interfaces.wan.name;
};
2024-07-17 14:18:35 -05:00
in {
enable = true;
2024-08-21 20:11:39 -05:00
checkRuleset = true;
2024-07-17 15:08:24 -05:00
ruleset = with inf; ''
table inet filter {
2024-07-18 15:54:50 -05:00
# set LANv4 {
# type ipv4_addr
# flags interval
# elements = { 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16 }
# }
# set LANv6 {
# type ipv6_addr
# flags interval
# elements = { fd00::/8, fe80::/10 }
# }
2024-07-17 15:19:41 -05:00
# TODO: maybe tailnet?
2024-07-17 14:18:35 -05:00
# chain my_input_lan {
# udp sport 1900 udp dport >= 1024 meta pkttype unicast limit rate 4/second burst 20 packets accept comment "Accept UPnP IGD port mapping reply"
# udp sport netbios-ns udp dport >= 1024 meta pkttype unicast accept comment "Accept Samba Workgroup browsing replies"
# }
2024-07-17 14:18:35 -05:00
2024-07-17 15:08:24 -05:00
chain input {
type filter hook input priority 0; policy drop;
iif lo accept comment "Accept any localhost traffic"
ct state invalid drop comment "Drop invalid connections"
ct state established,related accept comment "Accept traffic originated from us"
meta l4proto ipv6-icmp accept comment "Accept ICMPv6"
meta l4proto icmp accept comment "Accept ICMP"
ip protocol igmp accept comment "Accept IGMP"
2024-07-18 15:54:50 -05:00
ip6 nexthdr icmpv6 icmpv6 type nd-router-solicit accept
ip6 nexthdr icmpv6 icmpv6 type nd-router-advert accept comment "Accept IPv6 router advertisements"
2024-07-18 15:54:50 -05:00
udp dport dhcpv6-client accept comment "IPv6 DHCP"
ip6 nexthdr icmpv6 icmpv6 type { echo-request, nd-neighbor-solicit, nd-neighbor-advert, nd-router-solicit, nd-router-advert, mld-listener-query, destination-unreachable, packet-too-big, time-exceeded, parameter-problem } accept comment "Accept IPv6 ICMP and meta stuff"
ip protocol icmp icmp type { echo-request, destination-unreachable, router-advertisement, time-exceeded, parameter-problem } accept comment "Accept IPv4 ICMP and meta stuff"
ip protocol icmpv6 accept
ip protocol icmp accept
meta l4proto ipv6-icmp counter accept
udp dport dhcpv6-client counter accept
2024-07-17 15:08:24 -05:00
udp dport mdns ip6 daddr ff02::fb accept comment "Accept mDNS"
udp dport mdns ip daddr 224.0.0.251 accept comment "Accept mDNS"
2024-07-17 15:11:49 -05:00
tcp dport 2201 accept comment "Accept SSH on port 2201"
2024-07-17 16:27:54 -05:00
tcp dport 53 accept comment "Accept DNS"
udp dport 53 accept comment "Accept DNS"
2024-07-17 15:11:49 -05:00
2024-07-18 15:54:50 -05:00
tcp dport { 80, 443 } accept comment "Allow HTTP/HTTPS to server (see nat prerouting)"
udp dport { 80, 443 } accept comment "Allow QUIC to server (see nat prerouting)"
tcp dport { 22 } accept comment "Allow SSH to server (see nat prerouting)"
2024-07-19 12:15:39 -05:00
tcp dport { 25565 } accept comment "Allow Minecraft server connections (see nat prerouting)"
2024-07-17 15:08:24 -05:00
iifname "${lan}" accept comment "Allow local network to access the router"
iifname "tailscale0" accept comment "Allow local network to access the router"
2024-07-18 15:54:50 -05:00
# ip6 saddr @LANv6 jump my_input_lan comment "Connections from private IP address ranges"
# ip saddr @LANv4 jump my_input_lan comment "Connections from private IP address ranges"
2024-07-17 15:08:24 -05:00
iifname "${wan}" counter drop comment "Drop all other unsolicited traffic from wan"
}
2024-07-17 15:19:41 -05:00
chain output {
type filter hook output priority 0;
accept
}
2024-07-17 15:08:24 -05:00
chain forward {
type filter hook forward priority 0;
accept
2024-07-17 15:08:24 -05:00
}
# chain forward {
# type filter hook forward priority filter; policy drop;
# iifname { "${lan}" } oifname { "${wan}" } accept comment "Allow trusted LAN to WAN"
# iifname { "tailscale0" } oifname { "${wan}" } accept comment "Allow trusted LAN to WAN"
# iifname { "${wan}" } oifname { "${lan}" } ct state { established, related } accept comment "Allow established back to LAN"
# }
2024-07-17 15:08:24 -05:00
}
table ip nat {
2024-07-17 16:27:54 -05:00
chain prerouting {
type nat hook prerouting priority dstnat;
iifname ${lan} accept
iifname tailscale0 accept
2024-07-17 16:27:54 -05:00
2024-07-18 15:54:50 -05:00
iifname ${wan} tcp dport {22} dnat to ${hosts.beefcake.ip}
iifname ${wan} tcp dport {80, 443} dnat to ${hosts.beefcake.ip}
iifname ${wan} udp dport {80, 443} dnat to ${hosts.beefcake.ip}
2024-07-19 12:15:39 -05:00
iifname ${wan} tcp dport {26966} dnat to ${hosts.beefcake.ip}
iifname ${wan} tcp dport {25565} dnat to ${hosts.bald.ip}
iifname ${wan} udp dport {25565} dnat to ${hosts.bald.ip}
2024-07-17 16:27:54 -05:00
}
2024-07-17 15:08:24 -05:00
chain postrouting {
type nat hook postrouting priority 100; policy accept;
oifname "${wan}" masquerade
}
}
'';
2024-07-17 14:18:35 -05:00
};
2024-07-17 15:08:24 -05:00
2024-07-18 10:01:56 -05:00
# NOTE: see flake.nix 'nnf.nixosModules.default'
2024-07-17 15:08:24 -05:00
# nftables.firewall = let
# me = config.networking.nftables.firewall.localZoneName;
# in {
# enable = true;
# snippets.nnf-common.enable = true;
# zones = {
# ${interfaces.wan.name} = {
# interfaces = [interfaces.wan.name interfaces.lan.name];
# };
# ${interfaces.lan.name} = {
# parent = interfaces.wan.name;
# ipv4Addresses = [cidr];
# };
# # banned = {
# # ingressExpression = [
# # "ip saddr @banlist"
# # "ip6 saddr @banlist6"
# # ];
# # egressExpression = [
# # "ip daddr @banlist"
# # "ip6 daddr @banlist6"
# # ];
# # };
# };
# rules = {
# dhcp = {
# from = "all";
# to = [hosts.beefcake.ip];
# allowedTCPPorts = [67];
# allowedUDPPorts = [67];
# };
# http = {
# from = "all";
# to = [me];
# allowedTCPPorts = [80 443];
# };
# router-ssh = {
# from = "all";
# to = [me];
# allowedTCPPorts = [2201];
# };
# server-ssh = {
# from = "all";
# to = [hosts.beefcake.ip];
# allowedTCPPorts = [22];
# };
# };
# };
2024-07-16 20:34:02 -05:00
};
2024-07-16 20:34:02 -05:00
systemd.network = {
enable = true;
2024-07-17 16:27:54 -05:00
# wait-online.anyInterface = true;
2024-07-17 14:18:35 -05:00
2024-07-18 10:01:56 -05:00
# configure known names for the network interfaces
2024-07-17 14:18:35 -05:00
links = {
2024-07-17 16:27:54 -05:00
"20-${interfaces.wan.name}" = {
2024-07-17 14:18:35 -05:00
enable = true;
matchConfig = {
MACAddress = interfaces.wan.mac;
};
linkConfig = {
Name = interfaces.wan.name;
};
};
2024-07-17 16:27:54 -05:00
"30-${interfaces.lan.name}" = {
2024-07-17 14:18:35 -05:00
enable = true;
matchConfig = {
MACAddress = interfaces.lan.mac;
};
linkConfig = {
Name = interfaces.lan.name;
};
};
};
2024-07-18 10:01:56 -05:00
# configure networks for the interfaces
2024-07-16 20:34:02 -05:00
networks = {
2024-07-18 10:01:56 -05:00
# LAN configuration is very simple and mostly forwarded between
# TODO: IPv6
2024-07-17 16:27:54 -05:00
"50-${interfaces.lan.name}" = {
2024-07-17 14:18:35 -05:00
matchConfig.Name = "${interfaces.lan.name}";
linkConfig = {
RequiredForOnline = "enslaved";
# Name = interfaces.lan.name;
};
address = [
cidr
];
2024-07-16 20:34:02 -05:00
networkConfig = {
2024-07-18 15:54:50 -05:00
# Description = "LAN network - connection to switch in house";
2024-07-16 20:34:02 -05:00
ConfigureWithoutCarrier = true;
2024-07-18 15:54:50 -05:00
# IPv6AcceptRA = false;
IPv6SendRA = true;
2024-09-07 06:35:31 -05:00
DHCPPrefixDelegation = true;
2024-07-16 20:34:02 -05:00
};
};
2024-07-18 10:01:56 -05:00
# WAN configuration requires DHCP to get addresses
# we also disable some options to be certain we retain as much networking
# control as we reasonably can, such as not letting the ISP determine our
# hostname or DNS configuration
# TODO: IPv6 (prefix delegation)
2024-07-17 16:27:54 -05:00
"40-${interfaces.wan.name}" = {
2024-07-17 14:18:35 -05:00
matchConfig.Name = "${interfaces.wan.name}";
2024-07-16 20:34:02 -05:00
networkConfig = {
Description = "WAN network - connection to fiber ISP jack";
2024-07-18 10:01:56 -05:00
DHCP = true;
2024-07-18 15:54:50 -05:00
# IPv6AcceptRA = true;
# IPv6PrivacyExtensions = true;
# IPForward = true;
2024-07-16 20:34:02 -05:00
};
dhcpV6Config = {
# ForceDHCPv6PDOtherInformation = true;
2024-07-18 15:54:50 -05:00
# UseHostname = false;
# UseDNS = false;
# UseNTP = false;
PrefixDelegationHint = "::/56";
};
dhcpV4Config = {
Hostname = hostname;
UseHostname = false;
UseDNS = false;
UseNTP = false;
UseSIP = false;
UseRoutes = false;
UseGateway = true;
};
2024-07-17 14:18:35 -05:00
linkConfig = {
RequiredForOnline = "routable";
# Name = interfaces.wan.name;
};
ipv6AcceptRAConfig = {
DHCPv6Client = "always";
UseDNS = false;
};
2023-10-31 17:21:56 -05:00
};
};
};
2024-07-17 14:18:35 -05:00
services.resolved.enable = false;
2024-07-18 10:01:56 -05:00
# dnsmasq serves as our DHCP and DNS server
# almost all the configuration should be derived from the values at the top of
# this file
2024-07-17 14:18:35 -05:00
services.dnsmasq = {
enable = true;
settings = {
2024-07-17 15:08:24 -05:00
listen-address = "::,127.0.0.1,${ip}";
port = 53;
# dhcp-authoritative = true;
# dnssec = true;
2024-07-18 10:01:56 -05:00
enable-ra = true;
2024-07-17 15:08:24 -05:00
2024-07-17 16:27:54 -05:00
server = ["1.1.1.1" "9.9.9.9" "8.8.8.8"];
2024-07-17 14:18:35 -05:00
domain-needed = true;
bogus-priv = true;
no-resolv = true;
2024-07-17 15:08:24 -05:00
cache-size = "10000";
2024-07-17 14:18:35 -05:00
2024-09-03 20:03:24 -05:00
dhcp-range = with dhcp_lease_space; [
"${interfaces.lan.name},${min},${max},${netmask},24h"
"::,constructor:${interfaces.lan.name},ra-stateless,ra-names,4h"
];
2024-07-17 15:08:24 -05:00
except-interface = interfaces.wan.name;
2024-07-17 14:18:35 -05:00
interface = interfaces.lan.name;
dhcp-host =
[
]
++ (lib.attrsets.mapAttrsToList (name: {
ip,
identifier ? name,
time ? "12h",
2024-07-17 16:27:54 -05:00
...
2024-07-17 14:18:35 -05:00
}: "${name},${ip},${identifier},${time}")
hosts);
address =
[
"/${hostname}.${domain}/${ip}"
]
2024-07-17 16:27:54 -05:00
++ (lib.lists.flatten (lib.attrsets.mapAttrsToList (name: {
ip,
additionalHosts ? [],
identifier ? name,
time ? "12h",
}: [
"/${name}.${domain}/${ip}"
(lib.lists.forEach additionalHosts (h: "/${h}/${ip}"))
])
hosts));
2024-07-17 14:18:35 -05:00
# local domains
local = "/lan/";
domain = "lan";
expand-hosts = true;
# don't use /etc/hosts as this would advertise surfer as localhost
no-hosts = true;
};
};
2024-07-18 10:01:56 -05:00
# since the home network reserves port 22 for ssh to the big server and to
# gitea, the router uses port 2201 for ssh
2024-07-16 20:34:02 -05:00
services.openssh.listenAddresses = [
{
addr = "0.0.0.0";
port = 2201;
}
{
addr = "0.0.0.0";
port = 22;
}
{
addr = "[::]";
port = 2201;
}
{
addr = "[::]";
port = 22;
}
];
2024-07-18 10:01:56 -05:00
services.fail2ban.enable = true;
system.stateVersion = "24.05";
# NOTE: everything from here on is deprecated or old stuff
# TODO: may not be strictly necessary for IPv6?
# TODO: also may not even be the best implementation?
2024-07-16 16:57:45 -05:00
# services.radvd = {
# enable = false;
# # NOTE: this config is just the default arch linux config I think and may
# # need tweaking? this is what I had on the arch linux router, though :shrug:
# config = ''
# interface lo
# {
# AdvSendAdvert on;
# MinRtrAdvInterval 3;
# MaxRtrAdvInterval 10;
# AdvDefaultPreference low;
# AdvHomeAgentFlag off;
# prefix 2001:db8:1:0::/64
# {
# AdvOnLink on;
# AdvAutonomous on;
# AdvRouterAddr off;
# };
# prefix 0:0:0:1234::/64
# {
# AdvOnLink on;
# AdvAutonomous on;
# AdvRouterAddr off;
# Base6to4Interface ppp0;
# AdvPreferredLifetime 120;
# AdvValidLifetime 300;
# };
# route 2001:db0:fff::/48
# {
# AdvRoutePreference high;
# AdvRouteLifetime 3600;
# };
# RDNSS 2001:db8::1 2001:db8::2
# {
# AdvRDNSSLifetime 30;
# };
# DNSSL branch.example.com example.com
# {
# AdvDNSSLLifetime 30;
# };
# };
# '';
# };
2023-11-02 10:01:58 -05:00
2024-07-18 10:01:56 -05:00
# TODO: old config, should be deleted ASAP
2024-07-16 16:57:45 -05:00
# services.dnsmasq = {
# enable = false;
# settings = {
# # server endpoints
# listen-address = "::1,127.0.0.1,${ip}";
# port = "53";
# # DNS cache entries
# cache-size = "10000";
# # local domain entries
# local = "/lan/";
# domain = "lan";
# expand-hosts = true;
# dhcp-authoritative = true;
# conf-file = "/usr/share/dnsmasq/trust-anchors.conf";
# dnssec = true;
# except-interface = "${wan_if}";
# interface = "${lan_if}";
# enable-ra = true;
# # dhcp-option = "121,${cidr},${ip}";
# dhcp-range = [
# "lan,${dhcp_lease_space.min},${dhcp_lease_space.max},${netmask},10m"
# "tag:${lan_if},::1,constructor:${lan_if},ra-names,12h"
# ];
# dhcp-host = [
# "${hosts.dragon.host},${hosts.dragon.ip},12h"
# "${hosts.beefcake.host},${hosts.beefcake.ip},12h"
# ];
# # may need to go in /etc/hosts (networking.extraHosts), too?
# address = [
# "/video.lyte.dev/192.168.0.9"
# "/git.lyte.dev/192.168.0.9"
# "/bw.lyte.dev/192.168.0.9"
# "/files.lyte.dev/192.168.0.9"
# "/vpn.h.lyte.dev/192.168.0.9"
# "/.h.lyte.dev/192.168.0.9"
# ];
# server = [
# "${ip}"
# "8.8.8.8"
# "8.8.4.4"
# "1.1.1.1"
# "1.0.0.1"
# ];
# };
# };
2023-10-31 17:21:56 -05:00
2024-07-18 10:01:56 -05:00
# TODO: old config, should be deleted ASAP
2024-07-16 20:34:02 -05:00
# nftables = {
# enable = false;
# flushRuleset = true;
# tables = {
# filter = {
# family = "inet";
# content = ''
# chain input {
# # type filter hook input priority filter; policy accept;
# type filter hook input priority 0;
# # anything from loopback interface
# iifname "lo" accept
# # accept traffic we originated
# ct state { established, related } counter accept
# ct state invalid counter drop
# # ICMP
# ip6 nexthdr icmpv6 icmpv6 type { echo-request, nd-neighbor-solicit, nd-neighbor-advert, nd-router-solicit, nd-router-advert, mld-listener-query, destination-unreachable, packet-too-big, time-exceeded, parameter-problem } counter accept
# ip protocol icmp icmp type { echo-request, destination-unreachable, router-advertisement, time-exceeded, parameter-problem } counter accept
# ip protocol icmpv6 counter accept
# ip protocol icmp counter accept
# meta l4proto ipv6-icmp counter accept
# udp dport dhcpv6-client counter accept
# tcp dport { 64022, 22, 53, 67, 25565 } counter accept
# udp dport { 64020, 22, 53, 67 } counter accept
# # iifname "iot" ip saddr $iot-ip tcp dport { llmnr } counter accept
# # iifname "iot" ip saddr $iot-ip udp dport { mdns, llmnr } counter accept
# iifname "${lan_if}" tcp dport { llmnr } counter accept
# iifname "${lan_if}" udp dport { mdns, llmnr } counter accept
# counter drop
# }
# # allow all outgoing
# chain output {
# type filter hook output priority 0;
# accept
# }
# chain forward {
# type filter hook forward priority 0;
# accept
# }
# '';
# };
2024-07-16 10:48:32 -05:00
2024-07-16 20:34:02 -05:00
# nat = {
# family = "ip";
# content = ''
# set masq_saddr {
# type ipv4_addr
# flags interval
# elements = { ${cidr} }
# }
# map map_port_ipport {
# type inet_proto . inet_service : ipv4_addr . inet_service
# }
# chain prerouting {
# iifname ${lan_if} accept
# type nat hook prerouting priority dstnat + 1; policy accept;
# fib daddr type local dnat ip addr . port to meta l4proto . th dport map @map_port_ipport
# iifname ${wan_if} tcp dport { 22, 80, 443, 25565, 64022 } dnat to ${hosts.beefcake.ip}
# iifname ${wan_if} udp dport { 64020 } dnat to ${hosts.beefcake.ip}
# # iifname ${wan_if} tcp dport { 25565 } dnat to 192.168.0.244
# # iifname ${wan_if} udp dport { 25565 } dnat to 192.168.0.244
# # router
# iifname ${wan_if} tcp dport { 2201 } dnat to ${ip}
# }
# chain output {
# type nat hook output priority -99; policy accept;
# ip daddr != 127.0.0.0/8 oif "lo" dnat ip addr . port to meta l4proto . th dport map @map_port_ipport
# }
# chain postrouting {
# type nat hook postrouting priority srcnat + 1; policy accept;
# oifname ${lan_if} masquerade
# ip saddr @masq_saddr masquerade
# }
# '';
# };
# };
# };
2024-07-16 16:14:55 -05:00
2024-07-18 10:01:56 -05:00
# TODO: also want to try to avoid using dhcpcd for IPv6 since systemd-networkd
# should be sufficient?
2024-07-16 20:34:02 -05:00
# dhcpcd = {
# enable = false;
# extraConfig = ''
# duid
# # No way.... https://github.com/NetworkConfiguration/dhcpcd/issues/36#issuecomment-954777644
# # issues caused by guests with oneplus devices
# noarp
# persistent
# vendorclassid
# option domain_name_servers, domain_name, domain_search
# option classless_static_routes
# option interface_mtu
# option host_name
# #option ntp_servers
# require dhcp_server_identifier
# slaac private
# noipv4ll
# noipv6rs
# static domain_name_servers=${ip}
# interface ${wan_if}
# gateway
# ipv6rs
# iaid 1
# # option rapid_commit
# # ia_na 1
# ia_pd 1 ${lan_if}
# interface ${lan_if}
# static ip_address=${cidr}
# static routers=${ip}
# static domain_name_servers=${ip}
# '';
# };
2023-10-31 17:21:56 -05:00
}