blob: f5c866878f272bf32b89b65358c6d930b8ad4993 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
|
{
config,
lib,
pkgs,
...
}:
with lib; let
cnf = config.cynerd.router;
in {
options = {
cynerd.router = {
enable = mkOption {
type = types.bool;
default = false;
description = "Enable router support";
};
wan = mkOption {
type = types.str;
description = "Interface for the router's WAN";
};
lanIP = mkOption {
type = types.str;
description = "LAN IP address";
};
dynIPStart = mkOption {
type = types.ints.between 0 256;
default = 100;
description = "Offset for the dynamic IPv4 addresses";
};
dynIPCount = mkOption {
type = types.ints.between 0 256;
default = 100;
description = "Number of dynamically assigned IPv4 addresses";
};
lanPrefix = mkOption {
type = types.ints.between 0 32;
default = 24;
description = "LAN IP network prefix length";
};
};
};
config = mkIf cnf.enable {
networking = {
interfaces = {
brlan.ipv4.addresses = [
{
address = cnf.lanIP;
prefixLength = cnf.lanPrefix;
}
];
brguest.ipv4.addresses = [
{
address = "192.168.1.1";
prefixLength = 24;
}
];
};
vlans = {
"brlan.guest" = {
interface = "brlan";
id = 100;
};
};
bridges = {
brlan.interfaces = [];
brguest.interfaces = ["brlan.guest"];
};
nat = {
enable = true;
externalInterface = cnf.wan;
internalInterfaces = ["brlan" "brguest"];
};
dhcpcd.allowInterfaces = [cnf.wan];
nameservers = ["1.1.1.1" "8.8.8.8"];
};
services.dhcpd4 = {
enable = true;
authoritative = true;
interfaces = ["brlan" "brguest"];
extraConfig = ''
option domain-name-servers 1.1.1.1, 8.8.8.8;
subnet ${ipv4.prefix2ip cnf.lanIP cnf.lanPrefix} netmask ${ipv4.prefix2netmask cnf.lanPrefix} {
range ${
ipv4.ipAdd cnf.lanIP cnf.lanPrefix cnf.dynIPStart
} ${
ipv4.ipAdd cnf.lanIP cnf.lanPrefix (cnf.dynIPStart + cnf.dynIPCount)
};
option routers ${cnf.lanIP};
option subnet-mask ${ipv4.prefix2netmask cnf.lanPrefix};
option broadcast-address ${ipv4.prefix2broadcast cnf.lanIP cnf.lanPrefix};
}
subnet 192.168.1.0 netmask 255.255.255.0 {
range 192.168.1.50 192.168.1.254;
option routers 192.168.1.1;
option subnet-mask 255.255.255.0;
option broadcast-address 192.168.1.255;
}
'';
};
services.dhcpd6 = {
# TODO
enable = false;
authoritative = true;
interfaces = ["brlan"];
extraConfig = ''
'';
};
services.kresd = {
enable = false;
};
networking.nftables.enable = true;
networking.firewall = {
filterForward = true;
extraForwardRules = ''
iifname "brguest" oifname != "${cnf.wan}" drop comment "prevent guest to access lan"
'';
};
};
}
|
