{ config, lib, # outputs, pkgs, ... }: let /* NOTE: My goal is to be able to apply most of the common tweaks to the router either live on the system for ad-hoc changes (such as forwarding a port for a multiplayer game) or to tweak these values just below without reaching deeper into the modules' implementation of these configuration values NOTE: I could turn this into a cool NixOS module? TODO: review https://francis.begyn.be/blog/nixos-home-router TODO: more recent: https://github.com/ghostbuster91/blogposts/blob/a2374f0039f8cdf4faddeaaa0347661ffc2ec7cf/router2023-part2/main.md */ hostname = "router"; domain = "h.lyte.dev"; ip = "192.168.0.1"; cidr = "${ip}/16"; netmask = "255.255.255.0"; # see cidr dhcp_lease_space = { min = "192.168.0.30"; max = "192.168.0.250"; }; interfaces = { wan = { name = "wan"; mac = "00:01:2e:82:73:59"; }; lan = { name = "lan"; mac = "00:01:2e:82:73:5a"; }; }; hosts = { dragon = { ip = "192.168.0.10"; }; bald = { ip = "192.168.0.11"; additionalHosts = [ "ourcraft.lyte.dev" ]; }; beefcake = { ip = "192.168.0.9"; additionalHosts = [ ".beefcake.lan" "nix.h.lyte.dev" "idm.h.lyte.dev" "git.lyte.dev" "video.lyte.dev" "paperless.h.lyte.dev" "audio.lyte.dev" "a.lyte.dev" "bw.lyte.dev" "files.lyte.dev" "vpn.h.lyte.dev" "atuin.h.lyte.dev" "grafana.h.lyte.dev" "prometheus.h.lyte.dev" "finances.h.lyte.dev" "nextcloud.h.lyte.dev" "onlyoffice.h.lyte.dev" "a.lyte.dev" ]; }; }; sysctl-entries = { "net.ipv4.conf.all.forwarding" = true; "net.ipv6.conf.all.forwarding" = true; "net.ipv4.conf.default.rp_filter" = 1; "net.ipv4.conf.${interfaces.wan.name}.rp_filter" = 1; "net.ipv4.conf.${interfaces.lan.name}.rp_filter" = 0; "net.ipv6.conf.${interfaces.wan.name}.accept_ra" = 2; "net.ipv6.conf.${interfaces.wan.name}.autoconf" = 1; "net.ipv6.conf.all.use_tempaddr" = 2; "net.ipv6.conf.default.use_tempaddr" = lib.mkForce 2; "net.ipv6.conf.${interfaces.wan.name}.use_tempaddr" = 2; # "net.ipv6.conf.${interfaces.wan.name}.addr_gen_mode" = 2; }; in { imports = [ { # hardware boot = { loader = { efi.canTouchEfiVariables = true; systemd-boot.enable = true; }; initrd.availableKernelModules = ["xhci_pci"]; initrd.kernelModules = []; kernelModules = ["kvm-intel"]; extraModulePackages = []; }; nixpkgs.hostPlatform = "x86_64-linux"; powerManagement.cpuFreqGovernor = "performance"; hardware.cpu.intel.updateMicrocode = true; } ]; environment.systemPackages = with pkgs; [ iftop ]; sops = { defaultSopsFile = ../secrets/router/secrets.yml; age = { sshKeyPaths = ["/etc/ssh/ssh_host_ed25519_key"]; keyFile = "/var/lib/sops-nix/key.txt"; generateKey = true; }; secrets = { netlify-ddns-password = {mode = "0400";}; }; }; services.deno-netlify-ddns-client = { passwordFile = config.sops.secrets.netlify-ddns-password.path; }; boot.kernel.sysctl = sysctl-entries // { }; networking = { hostName = hostname; domain = domain; # disable some of the sane defaults useDHCP = false; firewall.enable = false; # use systemd.network for network interface configuration useNetworkd = true; # maybe we need this? nat.enable = true; extraHosts = '' 127.0.0.1 localhost 127.0.0.2 ${hostname}.${domain} ${hostname} ${ip} ${hostname}.${domain} ${hostname} ::1 localhost ip6-localhost ip6-loopback ff02::1 ip6-allnodes ff02::2 ip6-allrouters ''; # the main meat and potatoes for most routers, the firewall configuration # TODO: IPv6 nftables = let inf = { lan = interfaces.lan.name; wan = interfaces.wan.name; }; in { enable = true; checkRuleset = true; ruleset = with inf; '' table inet filter { ## set LANv4 { ## type ipv4_addr ## flags interval ## elements = { 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16 } ## } ## set LANv6 { ## type ipv6_addr ## flags interval ## elements = { fd00::/8, fe80::/10 } ## } ## TODO: maybe tailnet? ## chain my_input_lan { ## udp sport 1900 udp dport >= 1024 meta pkttype unicast limit rate 4/second burst 20 packets accept comment "Accept UPnP IGD port mapping reply" ## udp sport netbios-ns udp dport >= 1024 meta pkttype unicast accept comment "Accept Samba Workgroup browsing replies" ## } chain input { type filter hook input priority 0; policy drop; iif lo accept comment "Accept any localhost traffic" ct state invalid drop comment "Drop invalid connections" ct state established,related accept comment "Accept traffic originated from us" meta l4proto ipv6-icmp accept comment "Accept ICMPv6" meta l4proto icmp accept comment "Accept ICMP" ip protocol igmp accept comment "Accept IGMP" ip6 nexthdr icmpv6 icmpv6 type nd-router-solicit accept ip6 nexthdr icmpv6 icmpv6 type nd-router-advert accept comment "Accept IPv6 router advertisements" udp dport dhcpv6-client accept comment "IPv6 DHCP" ip6 nexthdr icmpv6 icmpv6 type { echo-request, nd-neighbor-solicit, nd-neighbor-advert, nd-router-solicit, nd-router-advert, mld-listener-query, destination-unreachable, packet-too-big, time-exceeded, parameter-problem } accept comment "Accept IPv6 ICMP and meta stuff" ip protocol icmp icmp type { echo-request, destination-unreachable, router-advertisement, time-exceeded, parameter-problem } accept comment "Accept IPv4 ICMP and meta stuff" ip protocol icmpv6 accept ip protocol icmp accept meta l4proto ipv6-icmp counter accept udp dport dhcpv6-client counter accept udp dport mdns ip6 daddr ff02::fb accept comment "Accept mDNS" udp dport mdns ip daddr 224.0.0.251 accept comment "Accept mDNS" tcp dport 2201 accept comment "Accept SSH on port 2201" tcp dport 53 accept comment "Accept DNS" udp dport 53 accept comment "Accept DNS" tcp dport { 80, 443 } accept comment "Allow HTTP/HTTPS to server (see nat prerouting)" udp dport { 80, 443 } accept comment "Allow QUIC to server (see nat prerouting)" tcp dport { 22 } accept comment "Allow SSH to server (see nat prerouting)" tcp dport { 25565 } accept comment "Allow Minecraft server connections (see nat prerouting)" udp dport { 34197 } accept comment "Allow Factorio server connections (see nat prerouting)" iifname "${lan}" accept comment "Allow local network to access the router" iifname "tailscale0" accept comment "Allow local network to access the router" ## ip6 saddr @LANv6 jump my_input_lan comment "Connections from private IP address ranges" ## ip saddr @LANv4 jump my_input_lan comment "Connections from private IP address ranges" iifname "${wan}" counter drop comment "Drop all other unsolicited traffic from wan" } chain output { type filter hook output priority 0; accept } chain forward { type filter hook forward priority 0; accept } ## chain forward { ## type filter hook forward priority filter; policy drop; ## iifname { "${lan}" } oifname { "${wan}" } accept comment "Allow trusted LAN to WAN" ## iifname { "tailscale0" } oifname { "${wan}" } accept comment "Allow trusted LAN to WAN" ## iifname { "${wan}" } oifname { "${lan}" } ct state { established, related } accept comment "Allow established back to LAN" ## } } table ip nat { chain prerouting { type nat hook prerouting priority dstnat; iifname ${lan} accept iifname tailscale0 accept iifname ${wan} tcp dport {22} dnat to ${hosts.beefcake.ip} iifname ${wan} tcp dport {80, 443} dnat to ${hosts.beefcake.ip} iifname ${wan} udp dport {80, 443} dnat to ${hosts.beefcake.ip} iifname ${wan} tcp dport {26966} dnat to ${hosts.beefcake.ip} iifname ${wan} tcp dport {25565} dnat to ${hosts.bald.ip} iifname ${wan} udp dport {25565} dnat to ${hosts.bald.ip} iifname ${wan} udp dport {34197} dnat to ${hosts.beefcake.ip} } chain postrouting { type nat hook postrouting priority 100; policy accept; oifname "${wan}" masquerade } } ''; }; # NOTE: see flake.nix 'nnf.nixosModules.default' /* nftables.firewall = let me = config.networking.nftables.firewall.localZoneName; in { enable = true; snippets.nnf-common.enable = true; zones = { ${interfaces.wan.name} = { interfaces = [interfaces.wan.name interfaces.lan.name]; }; ${interfaces.lan.name} = { parent = interfaces.wan.name; ipv4Addresses = [cidr]; }; ## banned = { ## ingressExpression = [ ## "ip saddr @banlist" ## "ip6 saddr @banlist6" ## ]; ## egressExpression = [ ## "ip daddr @banlist" ## "ip6 daddr @banlist6" ## ]; ## }; }; rules = { dhcp = { from = "all"; to = [hosts.beefcake.ip]; allowedTCPPorts = [67]; allowedUDPPorts = [67]; }; http = { from = "all"; to = [me]; allowedTCPPorts = [80 443]; }; router-ssh = { from = "all"; to = [me]; allowedTCPPorts = [2201]; }; server-ssh = { from = "all"; to = [hosts.beefcake.ip]; allowedTCPPorts = [22]; }; }; }; */ }; systemd.network = { enable = true; # wait-online.anyInterface = true; # configure known names for the network interfaces links = { "20-${interfaces.wan.name}" = { enable = true; matchConfig = { MACAddress = interfaces.wan.mac; }; linkConfig = { Name = interfaces.wan.name; }; }; "30-${interfaces.lan.name}" = { enable = true; matchConfig = { MACAddress = interfaces.lan.mac; }; linkConfig = { Name = interfaces.lan.name; }; }; }; # configure networks for the interfaces networks = { # LAN configuration is very simple and mostly forwarded between # TODO: IPv6 "50-${interfaces.lan.name}" = { matchConfig.Name = "${interfaces.lan.name}"; linkConfig = { RequiredForOnline = "enslaved"; # Name = interfaces.lan.name; }; address = [ cidr ]; networkConfig = { # Description = "LAN network - connection to switch in house"; ConfigureWithoutCarrier = true; # IPv6AcceptRA = false; IPv6SendRA = true; DHCPPrefixDelegation = true; }; }; /* WAN configuration requires DHCP to get addresses we also disable some options to be certain we retain as much networking control as we reasonably can, such as not letting the ISP determine our hostname or DNS configuration TODO: IPv6 (prefix delegation) */ "40-${interfaces.wan.name}" = { matchConfig.Name = "${interfaces.wan.name}"; networkConfig = { Description = "WAN network - connection to fiber ISP jack"; DHCP = true; /* IPv6AcceptRA = true; IPv6PrivacyExtensions = true; IPForward = true; */ }; dhcpV6Config = { /* ForceDHCPv6PDOtherInformation = true; UseHostname = false; UseDNS = false; UseNTP = false; */ PrefixDelegationHint = "::/56"; }; dhcpV4Config = { Hostname = hostname; UseHostname = false; UseDNS = false; UseNTP = false; UseSIP = false; UseRoutes = false; UseGateway = true; }; linkConfig = { RequiredForOnline = "routable"; # Name = interfaces.wan.name; }; ipv6AcceptRAConfig = { DHCPv6Client = "always"; UseDNS = false; }; }; }; }; services.resolved.enable = false; /* dnsmasq serves as our DHCP and DNS server almost all the configuration should be derived from the values at the top of this file */ services.dnsmasq = { enable = true; settings = { listen-address = "::,127.0.0.1,${ip}"; port = 53; /* dhcp-authoritative = true; dnssec = true; */ enable-ra = true; server = ["1.1.1.1" "9.9.9.9" "8.8.8.8"]; domain-needed = true; bogus-priv = true; no-resolv = true; cache-size = "10000"; dhcp-range = with dhcp_lease_space; [ "${interfaces.lan.name},${min},${max},${netmask},24h" "::,constructor:${interfaces.lan.name},ra-stateless,ra-names,4h" ]; except-interface = interfaces.wan.name; interface = interfaces.lan.name; dhcp-host = [ ] ++ (lib.attrsets.mapAttrsToList (name: { ip, identifier ? name, time ? "12h", ... }: "${name},${ip},${identifier},${time}") hosts); address = [ "/${hostname}.${domain}/${ip}" ] ++ (lib.lists.flatten (lib.attrsets.mapAttrsToList (name: { ip, additionalHosts ? [], identifier ? name, time ? "12h", }: [ "/${name}.${domain}/${ip}" (lib.lists.forEach additionalHosts (h: "/${h}/${ip}")) ]) hosts)); # local domains local = "/lan/"; domain = "lan"; expand-hosts = true; # don't use /etc/hosts as this would advertise surfer as localhost no-hosts = true; }; }; /* since the home network reserves port 22 for ssh to the big server and to gitea, the router uses port 2201 for ssh */ services.openssh.listenAddresses = [ { addr = "0.0.0.0"; port = 2201; } { addr = "0.0.0.0"; port = 22; } { addr = "[::]"; port = 2201; } { addr = "[::]"; port = 22; } ]; services.fail2ban.enable = true; system.stateVersion = "24.05"; /* NOTE: everything from here on is deprecated or old stuff TODO: may not be strictly necessary for IPv6? TODO: also may not even be the best implementation? services.radvd = { enable = false; ## NOTE: this config is just the default arch linux config I think and may ## need tweaking? this is what I had on the arch linux router, though :shrug: config = '' interface lo { AdvSendAdvert on; MinRtrAdvInterval 3; MaxRtrAdvInterval 10; AdvDefaultPreference low; AdvHomeAgentFlag off; prefix 2001:db8:1:0::/64 { AdvOnLink on; AdvAutonomous on; AdvRouterAddr off; }; prefix 0:0:0:1234::/64 { AdvOnLink on; AdvAutonomous on; AdvRouterAddr off; Base6to4Interface ppp0; AdvPreferredLifetime 120; AdvValidLifetime 300; }; route 2001:db0:fff::/48 { AdvRoutePreference high; AdvRouteLifetime 3600; }; RDNSS 2001:db8::1 2001:db8::2 { AdvRDNSSLifetime 30; }; DNSSL branch.example.com example.com { AdvDNSSLLifetime 30; }; }; ''; }; TODO: old config, should be deleted ASAP services.dnsmasq = { enable = false; settings = { # server endpoints listen-address = "::1,127.0.0.1,${ip}"; port = "53"; # DNS cache entries cache-size = "10000"; # local domain entries local = "/lan/"; domain = "lan"; expand-hosts = true; dhcp-authoritative = true; conf-file = "/usr/share/dnsmasq/trust-anchors.conf"; dnssec = true; except-interface = "${wan_if}"; interface = "${lan_if}"; enable-ra = true; # dhcp-option = "121,${cidr},${ip}"; dhcp-range = [ "lan,${dhcp_lease_space.min},${dhcp_lease_space.max},${netmask},10m" "tag:${lan_if},::1,constructor:${lan_if},ra-names,12h" ]; dhcp-host = [ "${hosts.dragon.host},${hosts.dragon.ip},12h" "${hosts.beefcake.host},${hosts.beefcake.ip},12h" ]; # may need to go in /etc/hosts (networking.extraHosts), too? address = [ "/video.lyte.dev/192.168.0.9" "/git.lyte.dev/192.168.0.9" "/bw.lyte.dev/192.168.0.9" "/files.lyte.dev/192.168.0.9" "/vpn.h.lyte.dev/192.168.0.9" "/.h.lyte.dev/192.168.0.9" ]; server = [ "${ip}" "8.8.8.8" "8.8.4.4" "1.1.1.1" "1.0.0.1" ]; }; }; TODO: old config, should be deleted ASAP nftables = { enable = false; flushRuleset = true; tables = { filter = { family = "inet"; content = '' chain input { # type filter hook input priority filter; policy accept; type filter hook input priority 0; # anything from loopback interface iifname "lo" accept # accept traffic we originated ct state { established, related } counter accept ct state invalid counter drop # ICMP ip6 nexthdr icmpv6 icmpv6 type { echo-request, nd-neighbor-solicit, nd-neighbor-advert, nd-router-solicit, nd-router-advert, mld-listener-query, destination-unreachable, packet-too-big, time-exceeded, parameter-problem } counter accept ip protocol icmp icmp type { echo-request, destination-unreachable, router-advertisement, time-exceeded, parameter-problem } counter accept ip protocol icmpv6 counter accept ip protocol icmp counter accept meta l4proto ipv6-icmp counter accept udp dport dhcpv6-client counter accept tcp dport { 64022, 22, 53, 67, 25565 } counter accept udp dport { 64020, 22, 53, 67 } counter accept ## iifname "iot" ip saddr $iot-ip tcp dport { llmnr } counter accept ## iifname "iot" ip saddr $iot-ip udp dport { mdns, llmnr } counter accept iifname "${lan_if}" tcp dport { llmnr } counter accept iifname "${lan_if}" udp dport { mdns, llmnr } counter accept counter drop } # allow all outgoing chain output { type filter hook output priority 0; accept } chain forward { type filter hook forward priority 0; accept } ''; }; nat = { family = "ip"; content = '' set masq_saddr { type ipv4_addr flags interval elements = { ${cidr} } } map map_port_ipport { type inet_proto . inet_service : ipv4_addr . inet_service } chain prerouting { iifname ${lan_if} accept type nat hook prerouting priority dstnat + 1; policy accept; fib daddr type local dnat ip addr . port to meta l4proto . th dport map @map_port_ipport iifname ${wan_if} tcp dport { 22, 80, 443, 25565, 64022 } dnat to ${hosts.beefcake.ip} iifname ${wan_if} udp dport { 64020 } dnat to ${hosts.beefcake.ip} ## iifname ${wan_if} tcp dport { 25565 } dnat to 192.168.0.244 ## iifname ${wan_if} udp dport { 25565 } dnat to 192.168.0.244 ## router iifname ${wan_if} tcp dport { 2201 } dnat to ${ip} } chain output { type nat hook output priority -99; policy accept; ip daddr != 127.0.0.0/8 oif "lo" dnat ip addr . port to meta l4proto . th dport map @map_port_ipport } chain postrouting { type nat hook postrouting priority srcnat + 1; policy accept; oifname ${lan_if} masquerade ip saddr @masq_saddr masquerade } ''; }; }; }; TODO: also want to try to avoid using dhcpcd for IPv6 since systemd-networkd should be sufficient? dhcpcd = { enable = false; extraConfig = '' duid ## No way.... https://github.com/NetworkConfiguration/dhcpcd/issues/36#issuecomment-954777644 ## issues caused by guests with oneplus devices noarp persistent vendorclassid option domain_name_servers, domain_name, domain_search option classless_static_routes option interface_mtu option host_name #option ntp_servers require dhcp_server_identifier slaac private noipv4ll noipv6rs static domain_name_servers=${ip} interface ${wan_if} gateway ipv6rs iaid 1 ## option rapid_commit ## ia_na 1 ia_pd 1 ${lan_if} interface ${lan_if} static ip_address=${cidr} static routers=${ip} static domain_name_servers=${ip} ''; }; */ }