Stuff
This commit is contained in:
parent
2b34c907b7
commit
bebdd082d2
1 changed files with 212 additions and 172 deletions
384
nixos/router.nix
384
nixos/router.nix
|
|
@ -1,12 +1,15 @@
|
||||||
{
|
{
|
||||||
lib,
|
lib,
|
||||||
# outputs,
|
# outputs,
|
||||||
# config,
|
config,
|
||||||
pkgs,
|
pkgs,
|
||||||
...
|
...
|
||||||
}: let
|
}: let
|
||||||
# NOTE: I could turn this into a cool NixOS module?
|
# NOTE: I could turn this into a cool NixOS module?
|
||||||
# TODO: review https://francis.begyn.be/blog/nixos-home-router
|
# TODO: review https://francis.begyn.be/blog/nixos-home-router
|
||||||
|
# TODO: more recent: https://github.com/ghostbuster91/blogposts/blob/a2374f0039f8cdf4faddeaaa0347661ffc2ec7cf/router2023-part2/main.md
|
||||||
|
hostname = "router";
|
||||||
|
domain = "h.lyte.dev";
|
||||||
ip = "192.168.0.1";
|
ip = "192.168.0.1";
|
||||||
cidr = "${ip}/16";
|
cidr = "${ip}/16";
|
||||||
netmask = "255.255.0.0"; # see cidr
|
netmask = "255.255.0.0"; # see cidr
|
||||||
|
|
@ -14,8 +17,16 @@
|
||||||
min = "192.168.0.5";
|
min = "192.168.0.5";
|
||||||
max = "192.168.0.250";
|
max = "192.168.0.250";
|
||||||
};
|
};
|
||||||
wan_if = "wan0";
|
interfaces = {
|
||||||
lan_if = "lan0";
|
wan = {
|
||||||
|
name = "wan0";
|
||||||
|
mac = "00:01:2e:82:73:59";
|
||||||
|
};
|
||||||
|
lan = {
|
||||||
|
name = "lan0";
|
||||||
|
mac = "00:01:2e:82:73:5a";
|
||||||
|
};
|
||||||
|
};
|
||||||
hosts = {
|
hosts = {
|
||||||
dragon = {
|
dragon = {
|
||||||
identifier = "dragon";
|
identifier = "dragon";
|
||||||
|
|
@ -28,6 +39,18 @@
|
||||||
ip = "192.168.0.9";
|
ip = "192.168.0.9";
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
sysctl-entries = {
|
||||||
|
"net.ipv4.conf.all.forwarding" = true;
|
||||||
|
"net.ipv6.conf.all.forwarding" = true;
|
||||||
|
|
||||||
|
# TODO: may want to disable this once it's working
|
||||||
|
# "net.ipv6.conf.all.accept_ra" = 0;
|
||||||
|
# "net.ipv6.conf.all.autoconf" = 0;
|
||||||
|
# "net.ipv6.conf.all.use_tempaddr" = 0;
|
||||||
|
|
||||||
|
# "net.ipv6.conf.${wan_if}.accept_ra" = 2;
|
||||||
|
# "net.ipv6.conf.${wan_if}.autoconf" = 1;
|
||||||
|
};
|
||||||
in {
|
in {
|
||||||
imports = [
|
imports = [
|
||||||
{
|
{
|
||||||
|
|
@ -51,21 +74,89 @@ in {
|
||||||
|
|
||||||
boot = {
|
boot = {
|
||||||
kernel = {
|
kernel = {
|
||||||
sysctl = {
|
sysctl = sysctl-entries;
|
||||||
"net.ipv4.conf.all.forwarding" = true;
|
};
|
||||||
"net.ipv6.conf.all.forwarding" = true;
|
};
|
||||||
|
|
||||||
# TODO: may want to disable this once it's working
|
environment = {
|
||||||
# "net.ipv6.conf.all.accept_ra" = 0;
|
systemPackages = with pkgs; [
|
||||||
# "net.ipv6.conf.all.autoconf" = 0;
|
wpa_supplicant
|
||||||
# "net.ipv6.conf.all.use_tempaddr" = 0;
|
inetutils
|
||||||
|
btop
|
||||||
|
htop
|
||||||
|
bottom
|
||||||
|
dog
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
"net.ipv6.conf.wan0.accept_ra" = 2;
|
networking = {
|
||||||
"net.ipv6.conf.wan0.autoconf" = 1;
|
hostName = hostname;
|
||||||
|
domain = domain;
|
||||||
|
useDHCP = false;
|
||||||
|
|
||||||
|
extraHosts = ''
|
||||||
|
127.0.0.1 localhost
|
||||||
|
127.0.0.2 ${hostname}.${domain} ${hostname}
|
||||||
|
${ip} ${hostname}.${domain} ${hostname}
|
||||||
|
|
||||||
|
::1 localhost ip6-localhost ip6-loopback
|
||||||
|
ff02::1 ip6-allnodes
|
||||||
|
kkkkk ff02::2 ip6-allrouters
|
||||||
|
'';
|
||||||
|
|
||||||
|
firewall.enable = true;
|
||||||
|
firewall.allowedTCPPorts = [
|
||||||
|
2201
|
||||||
|
22
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
|
systemd.network = {
|
||||||
|
enable = true;
|
||||||
|
wait-online.anyInterface = true;
|
||||||
|
networks = {
|
||||||
|
"30-${interfaces.lan.name}" = {
|
||||||
|
matchConfig.MACAddress = "${interfaces.lan.mac}";
|
||||||
|
linkConfig.RequiredForOnline = "enslaved";
|
||||||
|
networkConfig = {
|
||||||
|
ConfigureWithoutCarrier = true;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
"10-${interfaces.wan.name}" = {
|
||||||
|
matchConfig.MACAddress = "${interfaces.wan.mac}";
|
||||||
|
networkConfig = {
|
||||||
|
DHCP = true;
|
||||||
|
DNSOverTLS = true;
|
||||||
|
DNSSEC = true;
|
||||||
|
IPv6PrivacyExtensions = false;
|
||||||
|
IPForward = true;
|
||||||
|
};
|
||||||
|
linkConfig.RequiredForOnline = "routable";
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
|
systemd.services.systemd-networkd-wait-online.enable = lib.mkForce false;
|
||||||
|
|
||||||
|
services.openssh.listenAddresses = [
|
||||||
|
{
|
||||||
|
addr = "0.0.0.0";
|
||||||
|
port = 2201;
|
||||||
|
}
|
||||||
|
{
|
||||||
|
addr = "0.0.0.0";
|
||||||
|
port = 22;
|
||||||
|
}
|
||||||
|
{
|
||||||
|
addr = "[::]";
|
||||||
|
port = 2201;
|
||||||
|
}
|
||||||
|
{
|
||||||
|
addr = "[::]";
|
||||||
|
port = 22;
|
||||||
|
}
|
||||||
|
];
|
||||||
|
|
||||||
# # services.fail2ban.enable = true;
|
# # services.fail2ban.enable = true;
|
||||||
# services.radvd = {
|
# services.radvd = {
|
||||||
# enable = false;
|
# enable = false;
|
||||||
|
|
@ -181,193 +272,142 @@ in {
|
||||||
# };
|
# };
|
||||||
# };
|
# };
|
||||||
|
|
||||||
environment.systemPackages = with pkgs; [
|
# nftables = {
|
||||||
wpa_supplicant
|
# enable = false;
|
||||||
inetutils
|
# flushRuleset = true;
|
||||||
];
|
|
||||||
|
|
||||||
networking = {
|
# tables = {
|
||||||
hostName = "router";
|
# filter = {
|
||||||
domain = "h.lyte.dev";
|
# family = "inet";
|
||||||
useDHCP = true;
|
# content = ''
|
||||||
wireless.enable = true;
|
# chain input {
|
||||||
|
# # type filter hook input priority filter; policy accept;
|
||||||
|
# type filter hook input priority 0;
|
||||||
|
|
||||||
# useDHCP = true;
|
# # anything from loopback interface
|
||||||
# nat.enable = true; # TODO: maybe replace some of the nftables stuff with this module?
|
# iifname "lo" accept
|
||||||
|
|
||||||
extraHosts = ''
|
# # accept traffic we originated
|
||||||
127.0.0.1 localhost
|
# ct state { established, related } counter accept
|
||||||
${ip} router.h.lyte.dev router
|
# ct state invalid counter drop
|
||||||
|
|
||||||
::1 localhost ip6-localhost ip6-loopback
|
# # ICMP
|
||||||
ff02::1 ip6-allnodes
|
# ip6 nexthdr icmpv6 icmpv6 type { echo-request, nd-neighbor-solicit, nd-neighbor-advert, nd-router-solicit, nd-router-advert, mld-listener-query, destination-unreachable, packet-too-big, time-exceeded, parameter-problem } counter accept
|
||||||
ff02::2 ip6-allrouters
|
# ip protocol icmp icmp type { echo-request, destination-unreachable, router-advertisement, time-exceeded, parameter-problem } counter accept
|
||||||
'';
|
# ip protocol icmpv6 counter accept
|
||||||
|
# ip protocol icmp counter accept
|
||||||
|
# meta l4proto ipv6-icmp counter accept
|
||||||
|
|
||||||
firewall.enable = true;
|
# udp dport dhcpv6-client counter accept
|
||||||
firewall.allowedTCPPorts = [
|
|
||||||
2201
|
|
||||||
22
|
|
||||||
];
|
|
||||||
|
|
||||||
# nftables = {
|
# tcp dport { 64022, 22, 53, 67, 25565 } counter accept
|
||||||
# enable = false;
|
# udp dport { 64020, 22, 53, 67 } counter accept
|
||||||
# flushRuleset = true;
|
|
||||||
|
|
||||||
# tables = {
|
# # iifname "iot" ip saddr $iot-ip tcp dport { llmnr } counter accept
|
||||||
# filter = {
|
# # iifname "iot" ip saddr $iot-ip udp dport { mdns, llmnr } counter accept
|
||||||
# family = "inet";
|
# iifname "${lan_if}" tcp dport { llmnr } counter accept
|
||||||
# content = ''
|
# iifname "${lan_if}" udp dport { mdns, llmnr } counter accept
|
||||||
# chain input {
|
|
||||||
# # type filter hook input priority filter; policy accept;
|
|
||||||
# type filter hook input priority 0;
|
|
||||||
|
|
||||||
# # anything from loopback interface
|
# counter drop
|
||||||
# iifname "lo" accept
|
# }
|
||||||
|
|
||||||
# # accept traffic we originated
|
# # allow all outgoing
|
||||||
# ct state { established, related } counter accept
|
# chain output {
|
||||||
# ct state invalid counter drop
|
# type filter hook output priority 0;
|
||||||
|
# accept
|
||||||
|
# }
|
||||||
|
|
||||||
# # ICMP
|
# chain forward {
|
||||||
# ip6 nexthdr icmpv6 icmpv6 type { echo-request, nd-neighbor-solicit, nd-neighbor-advert, nd-router-solicit, nd-router-advert, mld-listener-query, destination-unreachable, packet-too-big, time-exceeded, parameter-problem } counter accept
|
# type filter hook forward priority 0;
|
||||||
# ip protocol icmp icmp type { echo-request, destination-unreachable, router-advertisement, time-exceeded, parameter-problem } counter accept
|
# accept
|
||||||
# ip protocol icmpv6 counter accept
|
# }
|
||||||
# ip protocol icmp counter accept
|
# '';
|
||||||
# meta l4proto ipv6-icmp counter accept
|
# };
|
||||||
|
|
||||||
# udp dport dhcpv6-client counter accept
|
# nat = {
|
||||||
|
# family = "ip";
|
||||||
|
# content = ''
|
||||||
|
# set masq_saddr {
|
||||||
|
# type ipv4_addr
|
||||||
|
# flags interval
|
||||||
|
# elements = { ${cidr} }
|
||||||
|
# }
|
||||||
|
|
||||||
# tcp dport { 64022, 22, 53, 67, 25565 } counter accept
|
# map map_port_ipport {
|
||||||
# udp dport { 64020, 22, 53, 67 } counter accept
|
# type inet_proto . inet_service : ipv4_addr . inet_service
|
||||||
|
# }
|
||||||
|
|
||||||
# # iifname "iot" ip saddr $iot-ip tcp dport { llmnr } counter accept
|
# chain prerouting {
|
||||||
# # iifname "iot" ip saddr $iot-ip udp dport { mdns, llmnr } counter accept
|
# iifname ${lan_if} accept
|
||||||
# iifname "${lan_if}" tcp dport { llmnr } counter accept
|
|
||||||
# iifname "${lan_if}" udp dport { mdns, llmnr } counter accept
|
|
||||||
|
|
||||||
# counter drop
|
# type nat hook prerouting priority dstnat + 1; policy accept;
|
||||||
# }
|
# fib daddr type local dnat ip addr . port to meta l4proto . th dport map @map_port_ipport
|
||||||
|
|
||||||
# # allow all outgoing
|
# iifname ${wan_if} tcp dport { 22, 80, 443, 25565, 64022 } dnat to ${hosts.beefcake.ip}
|
||||||
# chain output {
|
# iifname ${wan_if} udp dport { 64020 } dnat to ${hosts.beefcake.ip}
|
||||||
# type filter hook output priority 0;
|
|
||||||
# accept
|
|
||||||
# }
|
|
||||||
|
|
||||||
# chain forward {
|
# # iifname ${wan_if} tcp dport { 25565 } dnat to 192.168.0.244
|
||||||
# type filter hook forward priority 0;
|
# # iifname ${wan_if} udp dport { 25565 } dnat to 192.168.0.244
|
||||||
# accept
|
|
||||||
# }
|
|
||||||
# '';
|
|
||||||
# };
|
|
||||||
|
|
||||||
# nat = {
|
# # router
|
||||||
# family = "ip";
|
# iifname ${wan_if} tcp dport { 2201 } dnat to ${ip}
|
||||||
# content = ''
|
# }
|
||||||
# set masq_saddr {
|
|
||||||
# type ipv4_addr
|
|
||||||
# flags interval
|
|
||||||
# elements = { ${cidr} }
|
|
||||||
# }
|
|
||||||
|
|
||||||
# map map_port_ipport {
|
# chain output {
|
||||||
# type inet_proto . inet_service : ipv4_addr . inet_service
|
# type nat hook output priority -99; policy accept;
|
||||||
# }
|
# ip daddr != 127.0.0.0/8 oif "lo" dnat ip addr . port to meta l4proto . th dport map @map_port_ipport
|
||||||
|
# }
|
||||||
|
|
||||||
# chain prerouting {
|
# chain postrouting {
|
||||||
# iifname ${lan_if} accept
|
# type nat hook postrouting priority srcnat + 1; policy accept;
|
||||||
|
# oifname ${lan_if} masquerade
|
||||||
|
# ip saddr @masq_saddr masquerade
|
||||||
|
# }
|
||||||
|
# '';
|
||||||
|
# };
|
||||||
|
# };
|
||||||
|
# };
|
||||||
|
|
||||||
# type nat hook prerouting priority dstnat + 1; policy accept;
|
# dhcpcd = {
|
||||||
# fib daddr type local dnat ip addr . port to meta l4proto . th dport map @map_port_ipport
|
# enable = false;
|
||||||
|
# extraConfig = ''
|
||||||
|
# duid
|
||||||
|
|
||||||
# iifname ${wan_if} tcp dport { 22, 80, 443, 25565, 64022 } dnat to ${hosts.beefcake.ip}
|
# # No way.... https://github.com/NetworkConfiguration/dhcpcd/issues/36#issuecomment-954777644
|
||||||
# iifname ${wan_if} udp dport { 64020 } dnat to ${hosts.beefcake.ip}
|
# # issues caused by guests with oneplus devices
|
||||||
|
# noarp
|
||||||
|
|
||||||
# # iifname ${wan_if} tcp dport { 25565 } dnat to 192.168.0.244
|
# persistent
|
||||||
# # iifname ${wan_if} udp dport { 25565 } dnat to 192.168.0.244
|
# vendorclassid
|
||||||
|
|
||||||
# # router
|
# option domain_name_servers, domain_name, domain_search
|
||||||
# iifname ${wan_if} tcp dport { 2201 } dnat to ${ip}
|
# option classless_static_routes
|
||||||
# }
|
# option interface_mtu
|
||||||
|
# option host_name
|
||||||
|
# #option ntp_servers
|
||||||
|
|
||||||
# chain output {
|
# require dhcp_server_identifier
|
||||||
# type nat hook output priority -99; policy accept;
|
# slaac private
|
||||||
# ip daddr != 127.0.0.0/8 oif "lo" dnat ip addr . port to meta l4proto . th dport map @map_port_ipport
|
# noipv4ll
|
||||||
# }
|
# noipv6rs
|
||||||
|
|
||||||
# chain postrouting {
|
# static domain_name_servers=${ip}
|
||||||
# type nat hook postrouting priority srcnat + 1; policy accept;
|
|
||||||
# oifname ${lan_if} masquerade
|
|
||||||
# ip saddr @masq_saddr masquerade
|
|
||||||
# }
|
|
||||||
# '';
|
|
||||||
# };
|
|
||||||
# };
|
|
||||||
# };
|
|
||||||
|
|
||||||
# dhcpcd = {
|
# interface ${wan_if}
|
||||||
# enable = false;
|
# gateway
|
||||||
# extraConfig = ''
|
# ipv6rs
|
||||||
# duid
|
# iaid 1
|
||||||
|
# # option rapid_commit
|
||||||
# # No way.... https://github.com/NetworkConfiguration/dhcpcd/issues/36#issuecomment-954777644
|
# # ia_na 1
|
||||||
# # issues caused by guests with oneplus devices
|
# ia_pd 1 ${lan_if}
|
||||||
# noarp
|
|
||||||
|
|
||||||
# persistent
|
|
||||||
# vendorclassid
|
|
||||||
|
|
||||||
# option domain_name_servers, domain_name, domain_search
|
|
||||||
# option classless_static_routes
|
|
||||||
# option interface_mtu
|
|
||||||
# option host_name
|
|
||||||
# #option ntp_servers
|
|
||||||
|
|
||||||
# require dhcp_server_identifier
|
|
||||||
# slaac private
|
|
||||||
# noipv4ll
|
|
||||||
# noipv6rs
|
|
||||||
|
|
||||||
# static domain_name_servers=${ip}
|
|
||||||
|
|
||||||
# interface ${wan_if}
|
|
||||||
# gateway
|
|
||||||
# ipv6rs
|
|
||||||
# iaid 1
|
|
||||||
# # option rapid_commit
|
|
||||||
# # ia_na 1
|
|
||||||
# ia_pd 1 ${lan_if}
|
|
||||||
|
|
||||||
# interface ${lan_if}
|
|
||||||
# static ip_address=${cidr}
|
|
||||||
# static routers=${ip}
|
|
||||||
# static domain_name_servers=${ip}
|
|
||||||
# '';
|
|
||||||
# };
|
|
||||||
};
|
|
||||||
|
|
||||||
systemd.services.systemd-networkd-wait-online.enable = lib.mkForce false;
|
|
||||||
|
|
||||||
services.openssh.listenAddresses = [
|
|
||||||
{
|
|
||||||
addr = "0.0.0.0";
|
|
||||||
port = 2201;
|
|
||||||
}
|
|
||||||
{
|
|
||||||
addr = "0.0.0.0";
|
|
||||||
port = 22;
|
|
||||||
}
|
|
||||||
{
|
|
||||||
addr = "[::]";
|
|
||||||
port = 2201;
|
|
||||||
}
|
|
||||||
{
|
|
||||||
addr = "[::]";
|
|
||||||
port = 22;
|
|
||||||
}
|
|
||||||
];
|
|
||||||
|
|
||||||
|
# interface ${lan_if}
|
||||||
|
# static ip_address=${cidr}
|
||||||
|
# static routers=${ip}
|
||||||
|
# static domain_name_servers=${ip}
|
||||||
|
# '';
|
||||||
|
# };
|
||||||
|
# };
|
||||||
# systemd.network = {
|
# systemd.network = {
|
||||||
# enable = false;
|
# enable = false;
|
||||||
# networks = {
|
# networks = {
|
||||||
|
|
|
||||||
Loading…
Reference in a new issue