CaZzzer/nix-conf
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

WIP: router: router-2 experiment

Browse Source
This commit is contained in:
Yuri Tatishchev 2025-03-10 15:24:50 -07:00
parent 8997af1a18
commit 2d4a4985ed
Signed by: CaZzzer
GPG Key ID: 28BE602058C08557
1 changed files with 61 additions and 37 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

98
hosts/router/default.nix
View File

@ -4,10 +4,10 @@ let
ldomain = "l.${domain}"; ldomain = "l.${domain}";
sysdomain = "sys.${domain}"; sysdomain = "sys.${domain}";
links = { links = {
wanMAC = "bc:24:11:4f:c9:c4"; wanMAC = "bc:24:11:09:49:b0";
lanMAC = "bc:24:11:83:d8:de"; lanMAC = "bc:24:11:48:9c:85";
wanLL = "fe80::be24:11ff:fe4f:c9c4"; wanLL = "fe80::be24:11ff:fe09:49b0";
lanLL = "fe80::be24:11ff:fe83:d8de"; lanLL = "fe80::be24:11ff:fe48:9c85";
}; };
mkIfConfig = { mkIfConfig = {
@ -47,8 +47,9 @@ let
ifs = rec { ifs = rec {
wan = rec { wan = rec {
name = "wan"; name = "wan";
addr4 = "192.168.1.61"; addr4 = "192.168.1.62";
addr4Sized = "${addr4}/24"; p4Size = 24;
addr4Sized = "${addr4}/${toString p4Size}";
gw4 = "192.168.1.254"; gw4 = "192.168.1.254";
}; };
lan = mkIfConfig { lan = mkIfConfig {
@ -62,7 +63,7 @@ let
name_ = "${lan.name}.10"; name_ = "${lan.name}.10";
domain_ = "lab.${ldomain}"; domain_ = "lab.${ldomain}";
p4_ = "${p4}.10"; # .0/24 p4_ = "${p4}.10"; # .0/24
p6_ = "${pdFromWan}e"; # ::/64 p6_ = "${pdFromWan}9"; # ::/64
ulaPrefix_ = "${ulaPrefix}:0010"; # ::/64 ulaPrefix_ = "${ulaPrefix}:0010"; # ::/64
}; };
lan20 = mkIfConfig { lan20 = mkIfConfig {
@ -71,7 +72,7 @@ let
p4_ = "${p4}.20"; # .0/24 p4_ = "${p4}.20"; # .0/24
p6_ = "${pdFromWan}0"; # ::/64 managed by Att box p6_ = "${pdFromWan}0"; # ::/64 managed by Att box
ulaPrefix_ = "${ulaPrefix}:0020"; # ::/64 ulaPrefix_ = "${ulaPrefix}:0020"; # ::/64
ip6Token_ = "::1:1"; # override ipv6 for lan20, since the Att box uses ::1 here ip6Token_ = "::2:1"; # override ipv6 for lan20, since the Att box uses ::1 here
}; };
lan30 = mkIfConfig { lan30 = mkIfConfig {
name_ = "${lan.name}.30"; name_ = "${lan.name}.30";
@ -298,10 +299,15 @@ in
boot.loader.systemd-boot.configurationLimit = 5; boot.loader.systemd-boot.configurationLimit = 5;
boot.kernelPackages = pkgs.linuxKernel.packages.linux_6_12; boot.kernelPackages = pkgs.linuxKernel.packages.linux_6_12;
boot.growPartition = true; boot.growPartition = true;
# https://github.com/quic-go/quic-go/wiki/UDP-Buffer-Sizes boot.kernel.sysctl = {
# For upstream quic dns "net.ipv4.conf.all.forwarding" = true;
boot.kernel.sysctl."net.core.wmem_max" = 7500000; "net.ipv6.conf.all.forwarding" = true;
boot.kernel.sysctl."net.core.rmem_max" = 7500000;
# https://github.com/quic-go/quic-go/wiki/UDP-Buffer-Sizes
# For upstream quic dns
"net.core.wmem_max" = 7500000;
"net.core.rmem_max" = 7500000;
};
networking.hostName = "grouter"; networking.hostName = "grouter";
@ -335,18 +341,18 @@ in
# request the leases just for routing (so that the att box knows we're here) # request the leases just for routing (so that the att box knows we're here)
# actual ip assignments are static, based on $pdFromWan # actual ip assignments are static, based on $pdFromWan
ia_pd 1/${ifs.lan.net6} - # ia_pd 1/${ifs.lan.net6} -
ia_pd 10/${ifs.lan10.net6} - ia_pd 10/${ifs.lan10.net6} -
# ia_pd 20/${pdFromWan}d::/64 - # for opnsense (legacy services) # ia_pd 20/${pdFromWan}d::/64 - # for opnsense (legacy services)
ia_pd 30/${ifs.lan30.net6} - # ia_pd 30/${ifs.lan30.net6} -
ia_pd 40/${ifs.lan40.net6} - # ia_pd 40/${ifs.lan40.net6} -
ia_pd 50/${ifs.lan50.net6} - # ia_pd 50/${ifs.lan50.net6} -
# ia_pd 7 - # ia_pd 7 -
# ia_pd 8 - # ia_pd 8 -
''; '';
networking.useNetworkd = true; networking.useNetworkd = false;
systemd.network.enable = true; systemd.network.enable = false;
systemd.network = { systemd.network = {
# Global options # Global options
config.networkConfig = { config.networkConfig = {
@ -416,7 +422,23 @@ in
}; };
}; };
networking.vlans = {
${ifs.lan10.name} = { id = 10; interface = ifs.lan.name; };
};
networking.interfaces = { networking.interfaces = {
${ifs.wan.name} = {
useDHCP = true;
ipv4.addresses = [ { address = ifs.wan.addr4; prefixLength = ifs.wan.p4Size; } ];
ipv6.addresses = [
{
address = "${pdFromWan}0::1:1";
prefixLength = 64;
}
];
ipv4.routes = [
{ address = "0.0.0.0"; prefixLength = 0; via = ifs.wan.gw4; }
];
};
${ifs.lan10.name} = { ${ifs.lan10.name} = {
ipv4.addresses = [ { address = ifs.lan10.addr4; prefixLength = ifs.lan10.p4Size; } ]; ipv4.addresses = [ { address = ifs.lan10.addr4; prefixLength = ifs.lan10.p4Size; } ];
ipv6.addresses = [ ipv6.addresses = [
@ -497,8 +519,10 @@ in
# peculiarity due to wan and lan20 being bridged # peculiarity due to wan and lan20 being bridged
# TODO: figure out a less jank way to do this # TODO: figure out a less jank way to do this
iifname $ZONE_WAN_IFS ip6 saddr ${links.lanLL} icmpv6 type nd-router-advert log drop iifname $ZONE_WAN_IFS ip6 saddr ${links.lanLL} icmpv6 type nd-router-advert log drop
iifname $ZONE_WAN_IFS ip6 saddr fe80::be24:11ff:fe83:d8de icmpv6 type nd-router-advert log drop
# iifname $ZONE_WAN_IFS ip6 saddr ${links.lanLL} log drop # iifname $ZONE_WAN_IFS ip6 saddr ${links.lanLL} log drop
# iifname $ZONE_LAN_IFS ip6 saddr ${links.wanLL} log drop # iifname $ZONE_LAN_IFS ip6 saddr ${links.wanLL} log drop
ip6 nexthdr icmpv6 log prefix "ICMPv6: " accept
# Allow established and related connections # Allow established and related connections
# All icmp stuff should (theoretically) be handled by ct related # All icmp stuff should (theoretically) be handled by ct related
@ -524,7 +548,7 @@ in
iifname $ZONE_LAN_IFS jump zone_lan_input iifname $ZONE_LAN_IFS jump zone_lan_input
ip6 saddr $OPNSENSE_P6 jump zone_lan_input ip6 saddr $OPNSENSE_P6 jump zone_lan_input
log # log
} }
chain forward { chain forward {
@ -608,44 +632,44 @@ in
services.kea.dhcp4.enable = true; services.kea.dhcp4.enable = true;
services.kea.dhcp4.settings = { services.kea.dhcp4.settings = {
interfaces-config.interfaces = [ interfaces-config.interfaces = [
ifs.lan.name # ifs.lan.name
ifs.lan10.name ifs.lan10.name
ifs.lan20.name # ifs.lan20.name
ifs.lan30.name # ifs.lan30.name
ifs.lan40.name # ifs.lan40.name
ifs.lan50.name # ifs.lan50.name
]; ];
dhcp-ddns.enable-updates = true; dhcp-ddns.enable-updates = true;
ddns-qualifying-suffix = "4.default.${ldomain}"; ddns-qualifying-suffix = "4.default.${ldomain}";
subnet4 = [ subnet4 = [
((mkDhcp4Subnet 1 ifs.lan) // reservations.lan.v4) # ((mkDhcp4Subnet 1 ifs.lan) // reservations.lan.v4)
(mkDhcp4Subnet 10 ifs.lan10) (mkDhcp4Subnet 10 ifs.lan10)
((mkDhcp4Subnet 20 ifs.lan20) // reservations.lan20.v4) # ((mkDhcp4Subnet 20 ifs.lan20) // reservations.lan20.v4)
(mkDhcp4Subnet 30 ifs.lan30) # (mkDhcp4Subnet 30 ifs.lan30)
(mkDhcp4Subnet 40 ifs.lan40) # (mkDhcp4Subnet 40 ifs.lan40)
(mkDhcp4Subnet 50 ifs.lan50) # (mkDhcp4Subnet 50 ifs.lan50)
]; ];
}; };
services.kea.dhcp6.enable = true; services.kea.dhcp6.enable = true;
services.kea.dhcp6.settings = { services.kea.dhcp6.settings = {
interfaces-config.interfaces = [ interfaces-config.interfaces = [
ifs.lan.name # ifs.lan.name
ifs.lan10.name ifs.lan10.name
# ifs.lan20.name # Managed by Att box # ifs.lan20.name # Managed by Att box
ifs.lan30.name # ifs.lan30.name
ifs.lan40.name # ifs.lan40.name
ifs.lan50.name # ifs.lan50.name
]; ];
# TODO: https://kea.readthedocs.io/en/latest/arm/ddns.html#dual-stack-environments # TODO: https://kea.readthedocs.io/en/latest/arm/ddns.html#dual-stack-environments
dhcp-ddns.enable-updates = true; dhcp-ddns.enable-updates = true;
ddns-qualifying-suffix = "6.default.${ldomain}"; ddns-qualifying-suffix = "6.default.${ldomain}";
subnet6 = [ subnet6 = [
((mkDhcp6Subnet 1 ifs.lan) // reservations.lan.v6) # ((mkDhcp6Subnet 1 ifs.lan) // reservations.lan.v6)
(mkDhcp6Subnet 10 ifs.lan10) (mkDhcp6Subnet 10 ifs.lan10)
(mkDhcp6Subnet 30 ifs.lan30) # (mkDhcp6Subnet 30 ifs.lan30)
(mkDhcp6Subnet 40 ifs.lan40) # (mkDhcp6Subnet 40 ifs.lan40)
(mkDhcp6Subnet 50 ifs.lan50) # (mkDhcp6Subnet 50 ifs.lan50)
]; ];
}; };