nixos: some initial router configuration

5 files changed, 167 insertions, 78 deletions

diff --git a/nixos/machine/adm-omnia.nix b/nixos/machine/adm-omnia.nix
index 96e936f..e3a66e1 100644
--- a/nixos/machine/adm-omnia.nix
+++ b/nixos/machine/adm-omnia.nix
@@ -12,10 +12,14 @@ with lib; {
         wan = "end2"; # TODO pppoe-wan
         lanIP = config.cynerd.hosts.adm.omnia;
       };
+      wifiAP.adm = {
+        enable = true;
+        w24.interface = "wlp3s0";
+        w5.interface = "wlp2s0";
+      };
       openvpn.oldpersonal = false;
     };
 
-    # TODO pppd service requires end2 interface
     services.pppd = {
       enable = false;
       peers."wan".config = ''
@@ -33,38 +37,11 @@ with lib; {
         password 02
       '';
     };
+    #systemd.services."pppd-wan".after = ["sys-subsystem-net-devices-end2.device"];
 
     networking.bridges = {
-      brlan.interfaces = ["lan0" "lan1" "lan2" "lan3" "lan4"];
-    };
-
-    networking.wirelessAP = {
-      enable = true;
-      environmentFile = "/run/secrets/hostapd.env";
-      interfaces = {
-        "wlp2s0" = {
-          countryCode = "CZ";
-          hwMode = "a";
-          channel = 36;
-          ieee80211ac = true;
-          ht_capab = ["HT40+" "LDPC" "SHORT-GI-20" "SHORT-GI-40" "TX-STBC" "RX-STBC1" "MAX-AMSDU-7935" "DSSS_CCK-40"];
-          vht_capab = ["RXLDPC" "SHORT-GI-80" "TX-STBC-2BY1" "RX-ANTENNA-PATTERN" "TX-ANTENNA-PATTERN" "RX-STBC-1" "MAX-MPDU-11454" "MAX-A-MPDU-LEN-EXP7"];
-          ssid = "TurrisAdamkovi5";
-          wpa = 2;
-          wpaPassphrase = "@PASS_TURRIS_ADAMKOVI@";
-          bridge = "brlan";
-        };
-        "wlp3s0" = {
-          countryCode = "CZ";
-          hwMode = "g";
-          channel = 7;
-          ht_capab = ["HT40+" "SHORT-GI-20" "SHORT-GI-40" "TX-STBC" "RX-STBC1" "DSSS_CCK-40"];
-          ssid = "TurrisAdamkovi";
-          wpa = 2;
-          wpaPassphrase = "@PASS_TURRIS_ADAMKOVI@";
-          bridge = "brlan";
-        };
-      };
+      brlan.interfaces = ["lan1" "lan2" "lan3" "lan4"];
+      brguest.interfaces = ["lan0"];
     };
   };
 }
diff --git a/nixos/machine/adm-omnia2.nix b/nixos/machine/adm-omnia2.nix
index 3a47a84..ba71e7d 100644
--- a/nixos/machine/adm-omnia2.nix
+++ b/nixos/machine/adm-omnia2.nix
@@ -6,10 +6,25 @@
 }:
 with lib; {
   config = {
+    cynerd = {
+      wifiAP.adm = {
+        enable = true;
+        w24.interface = "wlp3s0";
+        w5.interface = "wlp2s0";
+      };
+    };
+
     networking = {
-      bridges.brlan.interfaces = [
-        "end2" "lan0" "lan1" "lan2" "lan3" "lan4"
-      ];
+      vlans = {
+        "brlan.guest" = {
+          interface = "brlan";
+          id = 100;
+        };
+      };
+      bridges = {
+        brlan.interfaces = [ "end2" "lan0" "lan1" "lan2" "lan3" "lan4" ];
+        brguest.interfaces = ["brlan.guest"];
+      };
       interfaces.brlan.ipv4.addresses = [
         {
           address = config.cynerd.hosts.adm.omnia2;
@@ -18,36 +33,7 @@ with lib; {
       ];
       defaultGateway = config.cynerd.hosts.adm.omnia;
       nameservers = ["1.1.1.1" "8.8.8.8"];
-      dhcpcd.allowInterfaces = ["lan"];
-    };
-
-    networking.wirelessAP = {
-      enable = true;
-      environmentFile = "/run/secrets/hostapd.env";
-      interfaces = {
-        "wlp2s0" = {
-          countryCode = "CZ";
-          hwMode = "a";
-          channel = 36;
-          ieee80211ac = true;
-          ht_capab = ["HT40+" "LDPC" "SHORT-GI-20" "SHORT-GI-40" "TX-STBC" "RX-STBC1" "MAX-AMSDU-7935" "DSSS_CCK-40"];
-          vht_capab = ["RXLDPC" "SHORT-GI-80" "TX-STBC-2BY1" "RX-ANTENNA-PATTERN" "TX-ANTENNA-PATTERN" "RX-STBC-1" "MAX-MPDU-11454" "MAX-A-MPDU-LEN-EXP7"];
-          ssid = "TurrisAdamkovi5";
-          wpa = 2;
-          wpaPassphrase = "@PASS_TURRIS_ADAMKOVI@";
-          bridge = "brlan";
-        };
-        "wlp3s0" = {
-          countryCode = "CZ";
-          hwMode = "g";
-          channel = 7;
-          ht_capab = ["HT40+" "SHORT-GI-20" "SHORT-GI-40" "TX-STBC" "RX-STBC1" "DSSS_CCK-40"];
-          ssid = "TurrisAdamkovi";
-          wpa = 2;
-          wpaPassphrase = "@PASS_TURRIS_ADAMKOVI@";
-          bridge = "brlan";
-        };
-      };
+      dhcpcd.allowInterfaces = [];
     };
   };
 }
diff --git a/nixos/modules/default.nix b/nixos/modules/default.nix
index bdab3b2..7d12eef 100644
--- a/nixos/modules/default.nix
+++ b/nixos/modules/default.nix
@@ -11,5 +11,6 @@
   cynerd-openvpn = import ./openvpn.nix;
   cynerd-router = import ./router.nix;
   cynerd-syncthing = import ./syncthing.nix;
+  cynerd-wifi-adm = import ./wifi-adm.nix;
   cynerd-wifi-client = import ./wifi-client.nix;
 }
diff --git a/nixos/modules/router.nix b/nixos/modules/router.nix
index e149633..f5c8668 100644
--- a/nixos/modules/router.nix
+++ b/nixos/modules/router.nix
@@ -18,11 +18,6 @@ in {
         type = types.str;
         description = "Interface for the router's WAN";
       };
-      brlan = mkOption {
-        type = types.str;
-        default = "brlan";
-        description = "LAN interface (commonly some bridge)";
-      };
       lanIP = mkOption {
         type = types.str;
         description = "LAN IP address";
@@ -47,16 +42,34 @@ in {
 
   config = mkIf cnf.enable {
     networking = {
-      interfaces."${cnf.brlan}".ipv4.addresses = [
-        {
-          address = cnf.lanIP;
-          prefixLength = cnf.lanPrefix;
-        }
-      ];
+      interfaces = {
+        brlan.ipv4.addresses = [
+          {
+            address = cnf.lanIP;
+            prefixLength = cnf.lanPrefix;
+          }
+        ];
+        brguest.ipv4.addresses = [
+          {
+            address = "192.168.1.1";
+            prefixLength = 24;
+          }
+        ];
+      };
+      vlans = {
+        "brlan.guest" = {
+          interface = "brlan";
+          id = 100;
+        };
+      };
+      bridges = {
+        brlan.interfaces = [];
+        brguest.interfaces = ["brlan.guest"];
+      };
       nat = {
         enable = true;
         externalInterface = cnf.wan;
-        internalInterfaces = [cnf.brlan];
+        internalInterfaces = ["brlan" "brguest"];
       };
       dhcpcd.allowInterfaces = [cnf.wan];
       nameservers = ["1.1.1.1" "8.8.8.8"];
@@ -65,7 +78,7 @@ in {
     services.dhcpd4 = {
       enable = true;
       authoritative = true;
-      interfaces = [cnf.brlan];
+      interfaces = ["brlan" "brguest"];
       extraConfig = ''
         option domain-name-servers 1.1.1.1, 8.8.8.8;
         subnet ${ipv4.prefix2ip cnf.lanIP cnf.lanPrefix} netmask ${ipv4.prefix2netmask cnf.lanPrefix} {
@@ -78,6 +91,12 @@ in {
             option subnet-mask ${ipv4.prefix2netmask cnf.lanPrefix};
             option broadcast-address ${ipv4.prefix2broadcast cnf.lanIP cnf.lanPrefix};
         }
+        subnet 192.168.1.0 netmask 255.255.255.0 {
+          range 192.168.1.50 192.168.1.254;
+          option routers 192.168.1.1;
+          option subnet-mask 255.255.255.0;
+          option broadcast-address 192.168.1.255;
+        }
       '';
     };
 
@@ -85,7 +104,7 @@ in {
       # TODO
       enable = false;
       authoritative = true;
-      interfaces = [cnf.brlan];
+      interfaces = ["brlan"];
       extraConfig = ''
       '';
     };
@@ -93,5 +112,13 @@ in {
     services.kresd = {
       enable = false;
     };
+
+    networking.nftables.enable = true;
+    networking.firewall = {
+      filterForward = true;
+      extraForwardRules = ''
+        iifname "brguest" oifname != "${cnf.wan}" drop comment "prevent guest to access lan"
+      '';
+    };
   };
 }
diff --git a/nixos/modules/wifi-adm.nix b/nixos/modules/wifi-adm.nix
new file mode 100644
index 0000000..46476a3
--- /dev/null
+++ b/nixos/modules/wifi-adm.nix
@@ -0,0 +1,98 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cnf = config.cynerd.wifiAP.adm;
+
+  wOptions = band: channelDefault: {
+    interface = mkOption {
+      type = with types; nullOr str;
+      default = null;
+      description = "Specify interface for ${band}";
+    };
+    channel = mkOption {
+      type = types.ints.positive;
+      default = channelDefault;
+      description = "Channel to be used for ${band} range";
+    };
+  };
+in {
+  options = {
+    cynerd.wifiAP.adm = {
+      enable = mkEnableOption "Enable Wi-Fi Access Point support";
+      w24 = wOptions "2.4GHz" 7;
+      w5 = wOptions "5GHz" 36;
+    };
+  };
+
+  config = mkIf cnf.enable {
+    networking.wirelessAP = {
+      enable = true;
+      environmentFile = "/run/secrets/hostapd.env";
+      interfaces =
+        (optionalAttrs (cnf.w24.interface != null) {
+          "${cnf.w24.interface}" = {
+            bssid = "@BSSID_W24_0@";
+            countryCode = "CZ";
+            hwMode = "g";
+            channel = cnf.w24.channel;
+            ht_capab = ["HT40+" "SHORT-GI-20" "SHORT-GI-40" "TX-STBC" "RX-STBC1" "DSSS_CCK-40"];
+            ssid = "TurrisAdamkovi";
+            wpa = 2;
+            wpaPassphrase = "@PASS_TURRIS_ADAMKOVI@";
+            bridge = "brlan";
+            bss = {
+              "wlp3s0.nela" = {
+                bssid = "@BSSID_W24_1@";
+                ssid = "Nela";
+                wpa = 2;
+                wpaPassphrase = "@PASS_NELA@";
+                bridge = "brguest";
+              };
+              "wlp3s0.milan" = {
+                bssid = "@BSSID_W24_2@";
+                ssid = "MILAN-AC";
+                wpa = 2;
+                wpaPassphrase = "@PASS_MILAN_AC@";
+                bridge = "brguest";
+              };
+            };
+          };
+        })
+        // (optionalAttrs (cnf.w5.interface != null) {
+          "${cnf.w5.interface}" = {
+            bssid = "@BSSID_W5_0@";
+            countryCode = "CZ";
+            hwMode = "a";
+            channel = cnf.w5.channel;
+            ieee80211ac = true;
+            ht_capab = ["HT40+" "LDPC" "SHORT-GI-20" "SHORT-GI-40" "TX-STBC" "RX-STBC1" "MAX-AMSDU-7935" "DSSS_CCK-40"];
+            vht_capab = ["RXLDPC" "SHORT-GI-80" "TX-STBC-2BY1" "RX-ANTENNA-PATTERN" "TX-ANTENNA-PATTERN" "RX-STBC-1" "MAX-MPDU-11454" "MAX-A-MPDU-LEN-EXP7"];
+            ssid = "TurrisAdamkovi5";
+            wpa = 2;
+            wpaPassphrase = "@PASS_TURRIS_ADAMKOVI@";
+            bridge = "brlan";
+            bss = {
+              "wlp2s0.nela" = {
+                bssid = "@BSSID_W5_1@";
+                ssid = "Nela5";
+                wpa = 2;
+                wpaPassphrase = "@PASS_NELA@";
+                bridge = "brguest";
+              };
+              "wlp2s0.milan" = {
+                bssid = "@BSSID_W5_2@";
+                ssid = "MILAN-AC";
+                wpa = 2;
+                wpaPassphrase = "@PASS_MILAN_AC@";
+                bridge = "brguest";
+              };
+            };
+          };
+        });
+    };
+  };
+}