{ config, lib, pkgs, ... }: with lib; let cnf = config.cynerd.router; in { options = { cynerd.router = { enable = mkOption { type = types.bool; default = false; description = "Enable router support"; }; wan = mkOption { type = types.str; description = "Interface for the router's WAN"; }; lanIP = mkOption { type = types.str; description = "LAN IP address"; }; dynIPStart = mkOption { type = types.ints.between 0 256; default = 100; description = "Offset for the dynamic IPv4 addresses"; }; dynIPCount = mkOption { type = types.ints.between 0 256; default = 100; description = "Number of dynamically assigned IPv4 addresses"; }; lanPrefix = mkOption { type = types.ints.between 0 32; default = 24; description = "LAN IP network prefix length"; }; }; }; config = mkIf cnf.enable { networking = { interfaces = { brlan.ipv4.addresses = [ { address = cnf.lanIP; prefixLength = cnf.lanPrefix; } ]; brguest.ipv4.addresses = [ { address = "192.168.1.1"; prefixLength = 24; } ]; }; vlans = { "brlan.guest" = { interface = "brlan"; id = 100; }; }; bridges = { brlan.interfaces = []; brguest.interfaces = ["brlan.guest"]; }; nat = { enable = true; externalInterface = cnf.wan; internalInterfaces = ["brlan" "brguest"]; }; dhcpcd.allowInterfaces = [cnf.wan]; nameservers = ["1.1.1.1" "8.8.8.8"]; }; services.kea = { dhcp4 = { enable = true; settings = { lease-database = { name = "/var/lib/kea/dhcp4.leases"; persist = true; type = "memfile"; }; valid-lifetime = 4000; renew-timer = 1000; rebind-timer = 2000; interfaces-config = { interfaces = ["brlan" "brguest"]; service-sockets-max-retries = -1; }; option-data = [ { name = "domain-name-servers"; data = "1.1.1.1, 8.8.8.8"; } ]; subnet4 = [ { interface = "brlan"; subnet = "${ipv4.prefix2ip cnf.lanIP cnf.lanPrefix}/${toString cnf.lanPrefix}"; pools = let ip_start = ipv4.ipAdd cnf.lanIP cnf.lanPrefix cnf.dynIPStart; ip_end = ipv4.ipAdd cnf.lanIP cnf.lanPrefix (cnf.dynIPStart + cnf.dynIPCount); in [{pool = "${ip_start} - ${ip_end}";}]; option-data = [ { name = "routers"; data = cnf.lanIP; } ]; reservations = [ { duid = "e4:6f:13:f3:d5:be"; ip-address = ipv4.ipAdd cnf.lanIP cnf.lanPrefix 60; } ]; } { interface = "brguest"; subnet = "192.168.1.0/24"; pools = [{pool = "192.168.1.50 - 192.168.1.254";}]; "option-data" = [ { name = "routers"; data = "192.168.1.1"; } ]; } ]; }; }; # TODO dhcp6 }; systemd.services.kea-dhcp4-server.after = [ "sys-subsystem-net-devices-brlan.device" "sys-subsystem-net-devices-brguest.device" ]; services.kresd = {enable = false;}; networking.nftables.enable = true; networking.firewall = { filterForward = true; extraForwardRules = '' iifname "brguest" oifname != "${cnf.wan}" drop comment "prevent guest to access lan" ''; }; }; }