aboutsummaryrefslogtreecommitdiff
path: root/nixos/routers/router.nix
diff options
context:
space:
mode:
Diffstat (limited to 'nixos/routers/router.nix')
-rw-r--r--nixos/routers/router.nix237
1 files changed, 59 insertions, 178 deletions
diff --git a/nixos/routers/router.nix b/nixos/routers/router.nix
index da625e4..545f109 100644
--- a/nixos/routers/router.nix
+++ b/nixos/routers/router.nix
@@ -40,33 +40,71 @@ in {
};
config = mkIf cnf.enable {
+ networking = {
+ useNetworkd = true;
+ nftables.enable = true;
+ firewall = {
+ interfaces = {
+ "lan" = {
+ allowedUDPPorts = [53 67 68];
+ allowedTCPPorts = [53];
+ };
+ "guest" = {
+ allowedUDPPorts = [53 67 68];
+ allowedTCPPorts = [53];
+ };
+ };
+ filterForward = true;
+ extraForwardRules = ''
+ iifname "guest" oifname != "${cnf.wan}" drop comment "prevent guest to access lan"
+ '';
+ };
+ nat = {
+ enable = true;
+ externalInterface = cnf.wan;
+ internalInterfaces = ["lan" "guest"];
+ };
+ };
+
systemd.network = {
netdevs = {
- "brlan".netdevConfig = {
- Kind = "bridge";
- Name = "brlan";
- };
- "brguest".netdevConfig = {
- Kind = "bridge";
- Name = "brguest";
+ "brlan" = {
+ netdevConfig = {
+ Kind = "bridge";
+ Name = "brlan";
+ };
+ extraConfig = ''
+ [Bridge]
+ DefaultPVID=none
+ VLANFiltering=yes
+ '';
};
- };
- networks = {
- "${cnf.wan}" = {
- matchConfig.Name = cnf.wan;
- networkConfig = {
- DHCP = "yes";
- DHCPPrefixDelegation = "yes";
+ "lan" = {
+ netdevConfig = {
+ Kind = "vlan";
+ Name = "lan";
};
- dhcpPrefixDelegationConfig = {
- UplinkInterface = ":self";
- SubnetId = 0;
- Announce = "no";
+ vlanConfig.Id = 1;
+ };
+ "guest" = {
+ netdevConfig = {
+ Kind = "vlan";
+ Name = "guest";
};
- linkConfig.RequiredForOnline = "routable";
+ vlanConfig.Id = 2;
};
+ };
+ networks = {
"brlan" = {
matchConfig.Name = "brlan";
+ networkConfig.VLAN = ["lan" "guest"];
+ bridgeVLANs = [
+ {bridgeVLANConfig.VLAN = 1;}
+ {bridgeVLANConfig.VLAN = 2;}
+ ];
+ };
+ "lan" = {
+ matchConfig.Name = "lan";
networkConfig = {
Address = "${cnf.lanIP}/${toString cnf.lanPrefix}";
IPForward = "yes";
@@ -74,7 +112,6 @@ in {
DHCPPrefixDelegation = "yes";
IPv6SendRA = "yes";
IPv6AcceptRA = "no";
- VLAN = ["brlan.brguest"];
};
dhcpServerConfig = {
UplinkInterface = cnf.wan;
@@ -89,8 +126,8 @@ in {
Announce = "yes";
};
};
- "brguest" = {
- matchConfig.Name = "brguest";
+ "guest" = {
+ matchConfig.Name = "guest";
networkConfig = {
Address = "192.168.1.1/24";
IPForward = "yes";
@@ -116,166 +153,10 @@ in {
wait-online.anyInterface = true;
};
- networking = {
- nftables.enable = true;
- firewall = {
- interfaces = {
- "brlan" = {
- allowedUDPPorts = [53 67 68];
- allowedTCPPorts = [53];
- };
- "brguest" = {
- allowedUDPPorts = [53 67 68];
- allowedTCPPorts = [53];
- };
- };
- filterForward = true;
- extraForwardRules = ''
- iifname "brguest" oifname != "${cnf.wan}" drop comment "prevent guest to access lan"
- '';
- };
- nat = {
- enable = true;
- externalInterface = cnf.wan;
- internalInterfaces = ["brlan" "brguest"];
- };
- };
-
services.resolved = {
enable = true;
dnssec = "true";
fallbackDns = ["1.1.1.1" "8.8.8.8"];
};
-
- #networking = {
- # interfaces = {
- # brlan.ipv4.addresses = [
- # {
- # address = cnf.lanIP;
- # prefixLength = cnf.lanPrefix;
- # }
- # ];
- # brguest.ipv4.addresses = [
- # {
- # address = "192.168.1.1";
- # prefixLength = 24;
- # }
- # ];
- # };
- # vlans = {
- # "brlan.guest" = {
- # interface = "brlan";
- # id = 100;
- # };
- # };
- # bridges = {
- # brlan.interfaces = [];
- # brguest.interfaces = ["brlan.guest"];
- # };
- # nat = {
- # enable = true;
- # externalInterface = cnf.wan;
- # internalInterfaces = ["brlan" "brguest"];
- # };
- # dhcpcd = {
- # allowInterfaces = [cnf.wan];
- # extraConfig = ''
- # duid
- # noipv6rs
- # waitip 6
-
- # interface ${cnf.wan}
- # ipv6rs
- # iaid 1
-
- # ia_pd 1 brlan
- # #ia_pd 1/::/64 LAN/0/64
- #toString '';
- # };
- #nameservers = ["1.1.1.1" "8.8.8.8"];
- #};
-
- #services = {
- # kea = {
- # dhcp4 = {
- # enable = true;
- # settings = {
- # lease-database = {
- # name = "/var/lib/kea/dhcp4.leases";
- # persist = true;
- # type = "memfile";
- # };
- # valid-lifetime = 4000;
- # renew-timer = 1000;
- # rebind-timer = 2000;
- # interfaces-config = {
- # interfaces = ["brlan" "brguest"];
- # service-sockets-max-retries = -1;
- # };
- # option-data = [
- # {
- # name = "domain-name-servers";
- # data = "1.1.1.1, 8.8.8.8";
- # }
- # ];
- # subnet4 = [
- # {
- # interface = "brlan";
- # subnet = "${ipv4.prefix2ip cnf.lanIP cnf.lanPrefix}/${toString cnf.lanPrefix}";
- # pools = let
- # ip_start = ipv4.ipAdd cnf.lanIP cnf.lanPrefix cnf.dynIPStart;
- # ip_end = ipv4.ipAdd cnf.lanIP cnf.lanPrefix (cnf.dynIPStart + cnf.dynIPCount);
- # in [{pool = "${ip_start} - ${ip_end}";}];
- # option-data = [
- # {
- # name = "routers";
- # data = cnf.lanIP;
- # }
- # ];
- # reservations = [
- # {
- # duid = "e4:6f:13:f3:d5:be";
- # ip-address = ipv4.ipAdd cnf.lanIP cnf.lanPrefix 60;
- # }
- # ];
- # }
- # {
- # interface = "brguest";
- # subnet = "192.168.1.0/24";
- # pools = [{pool = "192.168.1.50 - 192.168.1.254";}];
- # "option-data" = [
- # {
- # name = "routers";
- # data = "192.168.1.1";
- # }
- # ];
- # }
- # ];
- # };
- # };
- # };
- # radvd = {
- # enable = true;
- # config = ''
- # interface brlan {
- # AdvSendAdvert on;
- # MinRtrAdvInterval 3;
- # MaxRtrAdvInterval 10;
- # prefix ::/64 {
- # AdvOnLink on;
- # AdvAutonomous on;
- # AdvRouterAddr on;
- # };
- # RDNSS 2001:4860:4860::8888 2001:4860:4860::8844 {
- # };
- # };
- # '';
- # };
- # kresd = {enable = false;};
- #};
- #systemd.services.kea-dhcp4-server.after = [
- # "sys-subsystem-net-devices-brlan.device"
- # "sys-subsystem-net-devices-brguest.device"
- #];
};
}
generated by cgit v1.2.3 (git 2.25.1) at 2024-05-19 22:05:37 +0000