This commit is contained in:
Daniel Flanagan 2024-07-16 20:34:02 -05:00
parent 2b34c907b7
commit bebdd082d2

View file

@ -1,12 +1,15 @@
{ {
lib, lib,
# outputs, # outputs,
# config, config,
pkgs, pkgs,
... ...
}: let }: let
# NOTE: I could turn this into a cool NixOS module? # NOTE: I could turn this into a cool NixOS module?
# TODO: review https://francis.begyn.be/blog/nixos-home-router # TODO: review https://francis.begyn.be/blog/nixos-home-router
# TODO: more recent: https://github.com/ghostbuster91/blogposts/blob/a2374f0039f8cdf4faddeaaa0347661ffc2ec7cf/router2023-part2/main.md
hostname = "router";
domain = "h.lyte.dev";
ip = "192.168.0.1"; ip = "192.168.0.1";
cidr = "${ip}/16"; cidr = "${ip}/16";
netmask = "255.255.0.0"; # see cidr netmask = "255.255.0.0"; # see cidr
@ -14,8 +17,16 @@
min = "192.168.0.5"; min = "192.168.0.5";
max = "192.168.0.250"; max = "192.168.0.250";
}; };
wan_if = "wan0"; interfaces = {
lan_if = "lan0"; wan = {
name = "wan0";
mac = "00:01:2e:82:73:59";
};
lan = {
name = "lan0";
mac = "00:01:2e:82:73:5a";
};
};
hosts = { hosts = {
dragon = { dragon = {
identifier = "dragon"; identifier = "dragon";
@ -28,6 +39,18 @@
ip = "192.168.0.9"; ip = "192.168.0.9";
}; };
}; };
sysctl-entries = {
"net.ipv4.conf.all.forwarding" = true;
"net.ipv6.conf.all.forwarding" = true;
# TODO: may want to disable this once it's working
# "net.ipv6.conf.all.accept_ra" = 0;
# "net.ipv6.conf.all.autoconf" = 0;
# "net.ipv6.conf.all.use_tempaddr" = 0;
# "net.ipv6.conf.${wan_if}.accept_ra" = 2;
# "net.ipv6.conf.${wan_if}.autoconf" = 1;
};
in { in {
imports = [ imports = [
{ {
@ -51,21 +74,89 @@ in {
boot = { boot = {
kernel = { kernel = {
sysctl = { sysctl = sysctl-entries;
"net.ipv4.conf.all.forwarding" = true; };
"net.ipv6.conf.all.forwarding" = true; };
# TODO: may want to disable this once it's working environment = {
# "net.ipv6.conf.all.accept_ra" = 0; systemPackages = with pkgs; [
# "net.ipv6.conf.all.autoconf" = 0; wpa_supplicant
# "net.ipv6.conf.all.use_tempaddr" = 0; inetutils
btop
htop
bottom
dog
];
};
"net.ipv6.conf.wan0.accept_ra" = 2; networking = {
"net.ipv6.conf.wan0.autoconf" = 1; hostName = hostname;
domain = domain;
useDHCP = false;
extraHosts = ''
127.0.0.1 localhost
127.0.0.2 ${hostname}.${domain} ${hostname}
${ip} ${hostname}.${domain} ${hostname}
::1 localhost ip6-localhost ip6-loopback
ff02::1 ip6-allnodes
kkkkk ff02::2 ip6-allrouters
'';
firewall.enable = true;
firewall.allowedTCPPorts = [
2201
22
];
};
systemd.network = {
enable = true;
wait-online.anyInterface = true;
networks = {
"30-${interfaces.lan.name}" = {
matchConfig.MACAddress = "${interfaces.lan.mac}";
linkConfig.RequiredForOnline = "enslaved";
networkConfig = {
ConfigureWithoutCarrier = true;
};
};
"10-${interfaces.wan.name}" = {
matchConfig.MACAddress = "${interfaces.wan.mac}";
networkConfig = {
DHCP = true;
DNSOverTLS = true;
DNSSEC = true;
IPv6PrivacyExtensions = false;
IPForward = true;
};
linkConfig.RequiredForOnline = "routable";
}; };
}; };
}; };
systemd.services.systemd-networkd-wait-online.enable = lib.mkForce false;
services.openssh.listenAddresses = [
{
addr = "0.0.0.0";
port = 2201;
}
{
addr = "0.0.0.0";
port = 22;
}
{
addr = "[::]";
port = 2201;
}
{
addr = "[::]";
port = 22;
}
];
# # services.fail2ban.enable = true; # # services.fail2ban.enable = true;
# services.radvd = { # services.radvd = {
# enable = false; # enable = false;
@ -181,193 +272,142 @@ in {
# }; # };
# }; # };
environment.systemPackages = with pkgs; [ # nftables = {
wpa_supplicant # enable = false;
inetutils # flushRuleset = true;
];
networking = { # tables = {
hostName = "router"; # filter = {
domain = "h.lyte.dev"; # family = "inet";
useDHCP = true; # content = ''
wireless.enable = true; # chain input {
# # type filter hook input priority filter; policy accept;
# type filter hook input priority 0;
# useDHCP = true; # # anything from loopback interface
# nat.enable = true; # TODO: maybe replace some of the nftables stuff with this module? # iifname "lo" accept
extraHosts = '' # # accept traffic we originated
127.0.0.1 localhost # ct state { established, related } counter accept
${ip} router.h.lyte.dev router # ct state invalid counter drop
::1 localhost ip6-localhost ip6-loopback # # ICMP
ff02::1 ip6-allnodes # ip6 nexthdr icmpv6 icmpv6 type { echo-request, nd-neighbor-solicit, nd-neighbor-advert, nd-router-solicit, nd-router-advert, mld-listener-query, destination-unreachable, packet-too-big, time-exceeded, parameter-problem } counter accept
ff02::2 ip6-allrouters # ip protocol icmp icmp type { echo-request, destination-unreachable, router-advertisement, time-exceeded, parameter-problem } counter accept
''; # ip protocol icmpv6 counter accept
# ip protocol icmp counter accept
# meta l4proto ipv6-icmp counter accept
firewall.enable = true; # udp dport dhcpv6-client counter accept
firewall.allowedTCPPorts = [
2201
22
];
# nftables = { # tcp dport { 64022, 22, 53, 67, 25565 } counter accept
# enable = false; # udp dport { 64020, 22, 53, 67 } counter accept
# flushRuleset = true;
# tables = { # # iifname "iot" ip saddr $iot-ip tcp dport { llmnr } counter accept
# filter = { # # iifname "iot" ip saddr $iot-ip udp dport { mdns, llmnr } counter accept
# family = "inet"; # iifname "${lan_if}" tcp dport { llmnr } counter accept
# content = '' # iifname "${lan_if}" udp dport { mdns, llmnr } counter accept
# chain input {
# # type filter hook input priority filter; policy accept;
# type filter hook input priority 0;
# # anything from loopback interface # counter drop
# iifname "lo" accept # }
# # accept traffic we originated # # allow all outgoing
# ct state { established, related } counter accept # chain output {
# ct state invalid counter drop # type filter hook output priority 0;
# accept
# }
# # ICMP # chain forward {
# ip6 nexthdr icmpv6 icmpv6 type { echo-request, nd-neighbor-solicit, nd-neighbor-advert, nd-router-solicit, nd-router-advert, mld-listener-query, destination-unreachable, packet-too-big, time-exceeded, parameter-problem } counter accept # type filter hook forward priority 0;
# ip protocol icmp icmp type { echo-request, destination-unreachable, router-advertisement, time-exceeded, parameter-problem } counter accept # accept
# ip protocol icmpv6 counter accept # }
# ip protocol icmp counter accept # '';
# meta l4proto ipv6-icmp counter accept # };
# udp dport dhcpv6-client counter accept # nat = {
# family = "ip";
# content = ''
# set masq_saddr {
# type ipv4_addr
# flags interval
# elements = { ${cidr} }
# }
# tcp dport { 64022, 22, 53, 67, 25565 } counter accept # map map_port_ipport {
# udp dport { 64020, 22, 53, 67 } counter accept # type inet_proto . inet_service : ipv4_addr . inet_service
# }
# # iifname "iot" ip saddr $iot-ip tcp dport { llmnr } counter accept # chain prerouting {
# # iifname "iot" ip saddr $iot-ip udp dport { mdns, llmnr } counter accept # iifname ${lan_if} accept
# iifname "${lan_if}" tcp dport { llmnr } counter accept
# iifname "${lan_if}" udp dport { mdns, llmnr } counter accept
# counter drop # type nat hook prerouting priority dstnat + 1; policy accept;
# } # fib daddr type local dnat ip addr . port to meta l4proto . th dport map @map_port_ipport
# # allow all outgoing # iifname ${wan_if} tcp dport { 22, 80, 443, 25565, 64022 } dnat to ${hosts.beefcake.ip}
# chain output { # iifname ${wan_if} udp dport { 64020 } dnat to ${hosts.beefcake.ip}
# type filter hook output priority 0;
# accept
# }
# chain forward { # # iifname ${wan_if} tcp dport { 25565 } dnat to 192.168.0.244
# type filter hook forward priority 0; # # iifname ${wan_if} udp dport { 25565 } dnat to 192.168.0.244
# accept
# }
# '';
# };
# nat = { # # router
# family = "ip"; # iifname ${wan_if} tcp dport { 2201 } dnat to ${ip}
# content = '' # }
# set masq_saddr {
# type ipv4_addr
# flags interval
# elements = { ${cidr} }
# }
# map map_port_ipport { # chain output {
# type inet_proto . inet_service : ipv4_addr . inet_service # type nat hook output priority -99; policy accept;
# } # ip daddr != 127.0.0.0/8 oif "lo" dnat ip addr . port to meta l4proto . th dport map @map_port_ipport
# }
# chain prerouting { # chain postrouting {
# iifname ${lan_if} accept # type nat hook postrouting priority srcnat + 1; policy accept;
# oifname ${lan_if} masquerade
# ip saddr @masq_saddr masquerade
# }
# '';
# };
# };
# };
# type nat hook prerouting priority dstnat + 1; policy accept; # dhcpcd = {
# fib daddr type local dnat ip addr . port to meta l4proto . th dport map @map_port_ipport # enable = false;
# extraConfig = ''
# duid
# iifname ${wan_if} tcp dport { 22, 80, 443, 25565, 64022 } dnat to ${hosts.beefcake.ip} # # No way.... https://github.com/NetworkConfiguration/dhcpcd/issues/36#issuecomment-954777644
# iifname ${wan_if} udp dport { 64020 } dnat to ${hosts.beefcake.ip} # # issues caused by guests with oneplus devices
# noarp
# # iifname ${wan_if} tcp dport { 25565 } dnat to 192.168.0.244 # persistent
# # iifname ${wan_if} udp dport { 25565 } dnat to 192.168.0.244 # vendorclassid
# # router # option domain_name_servers, domain_name, domain_search
# iifname ${wan_if} tcp dport { 2201 } dnat to ${ip} # option classless_static_routes
# } # option interface_mtu
# option host_name
# #option ntp_servers
# chain output { # require dhcp_server_identifier
# type nat hook output priority -99; policy accept; # slaac private
# ip daddr != 127.0.0.0/8 oif "lo" dnat ip addr . port to meta l4proto . th dport map @map_port_ipport # noipv4ll
# } # noipv6rs
# chain postrouting { # static domain_name_servers=${ip}
# type nat hook postrouting priority srcnat + 1; policy accept;
# oifname ${lan_if} masquerade
# ip saddr @masq_saddr masquerade
# }
# '';
# };
# };
# };
# dhcpcd = { # interface ${wan_if}
# enable = false; # gateway
# extraConfig = '' # ipv6rs
# duid # iaid 1
# # option rapid_commit
# # No way.... https://github.com/NetworkConfiguration/dhcpcd/issues/36#issuecomment-954777644 # # ia_na 1
# # issues caused by guests with oneplus devices # ia_pd 1 ${lan_if}
# noarp
# persistent
# vendorclassid
# option domain_name_servers, domain_name, domain_search
# option classless_static_routes
# option interface_mtu
# option host_name
# #option ntp_servers
# require dhcp_server_identifier
# slaac private
# noipv4ll
# noipv6rs
# static domain_name_servers=${ip}
# interface ${wan_if}
# gateway
# ipv6rs
# iaid 1
# # option rapid_commit
# # ia_na 1
# ia_pd 1 ${lan_if}
# interface ${lan_if}
# static ip_address=${cidr}
# static routers=${ip}
# static domain_name_servers=${ip}
# '';
# };
};
systemd.services.systemd-networkd-wait-online.enable = lib.mkForce false;
services.openssh.listenAddresses = [
{
addr = "0.0.0.0";
port = 2201;
}
{
addr = "0.0.0.0";
port = 22;
}
{
addr = "[::]";
port = 2201;
}
{
addr = "[::]";
port = 22;
}
];
# interface ${lan_if}
# static ip_address=${cidr}
# static routers=${ip}
# static domain_name_servers=${ip}
# '';
# };
# };
# systemd.network = { # systemd.network = {
# enable = false; # enable = false;
# networks = { # networks = {