CaZzzer/nix-conf
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

WIP: router: router-2 experiment

Browse Source
This commit is contained in:
Yuri Tatishchev 2025-03-10 15:24:50 -07:00
parent 8997af1a18
commit 2d4a4985ed
Signed by: CaZzzer
GPG Key ID: 28BE602058C08557
1 changed files with 61 additions and 37 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

94
hosts/router/default.nix
View File

@ -4,10 +4,10 @@ let
ldomain = "l.${domain}";
sysdomain = "sys.${domain}";
links = {
wanMAC = "bc:24:11:4f:c9:c4";
lanMAC = "bc:24:11:83:d8:de";
wanLL = "fe80::be24:11ff:fe4f:c9c4";
lanLL = "fe80::be24:11ff:fe83:d8de";
wanMAC = "bc:24:11:09:49:b0";
lanMAC = "bc:24:11:48:9c:85";
wanLL = "fe80::be24:11ff:fe09:49b0";
lanLL = "fe80::be24:11ff:fe48:9c85";
};
mkIfConfig = {
@ -47,8 +47,9 @@ let
ifs = rec {
wan = rec {
name = "wan";
addr4 = "192.168.1.61";
addr4Sized = "${addr4}/24";
addr4 = "192.168.1.62";
p4Size = 24;
addr4Sized = "${addr4}/${toString p4Size}";
gw4 = "192.168.1.254";
};
lan = mkIfConfig {
@ -62,7 +63,7 @@ let
name_ = "${lan.name}.10";
domain_ = "lab.${ldomain}";
p4_ = "${p4}.10"; # .0/24
p6_ = "${pdFromWan}e"; # ::/64
p6_ = "${pdFromWan}9"; # ::/64
ulaPrefix_ = "${ulaPrefix}:0010"; # ::/64
};
lan20 = mkIfConfig {
@ -71,7 +72,7 @@ let
p4_ = "${p4}.20"; # .0/24
p6_ = "${pdFromWan}0"; # ::/64 managed by Att box
ulaPrefix_ = "${ulaPrefix}:0020"; # ::/64
ip6Token_ = "::1:1"; # override ipv6 for lan20, since the Att box uses ::1 here
ip6Token_ = "::2:1"; # override ipv6 for lan20, since the Att box uses ::1 here
};
lan30 = mkIfConfig {
name_ = "${lan.name}.30";
@ -298,10 +299,15 @@ in
boot.loader.systemd-boot.configurationLimit = 5;
boot.kernelPackages = pkgs.linuxKernel.packages.linux_6_12;
boot.growPartition = true;
boot.kernel.sysctl = {
"net.ipv4.conf.all.forwarding" = true;
"net.ipv6.conf.all.forwarding" = true;
# https://github.com/quic-go/quic-go/wiki/UDP-Buffer-Sizes
# For upstream quic dns
boot.kernel.sysctl."net.core.wmem_max" = 7500000;
boot.kernel.sysctl."net.core.rmem_max" = 7500000;
"net.core.wmem_max" = 7500000;
"net.core.rmem_max" = 7500000;
};
networking.hostName = "grouter";
@ -335,18 +341,18 @@ in
# request the leases just for routing (so that the att box knows we're here)
# actual ip assignments are static, based on $pdFromWan
ia_pd 1/${ifs.lan.net6} -
# ia_pd 1/${ifs.lan.net6} -
ia_pd 10/${ifs.lan10.net6} -
# ia_pd 20/${pdFromWan}d::/64 - # for opnsense (legacy services)
ia_pd 30/${ifs.lan30.net6} -
ia_pd 40/${ifs.lan40.net6} -
ia_pd 50/${ifs.lan50.net6} -
# ia_pd 30/${ifs.lan30.net6} -
# ia_pd 40/${ifs.lan40.net6} -
# ia_pd 50/${ifs.lan50.net6} -
# ia_pd 7 -
# ia_pd 8 -
'';
networking.useNetworkd = true;
systemd.network.enable = true;
networking.useNetworkd = false;
systemd.network.enable = false;
systemd.network = {
# Global options
config.networkConfig = {
@ -416,7 +422,23 @@ in
};
};
networking.vlans = {
${ifs.lan10.name} = { id = 10; interface = ifs.lan.name; };
};
networking.interfaces = {
${ifs.wan.name} = {
useDHCP = true;
ipv4.addresses = [ { address = ifs.wan.addr4; prefixLength = ifs.wan.p4Size; } ];
ipv6.addresses = [
{
address = "${pdFromWan}0::1:1";
prefixLength = 64;
}
];
ipv4.routes = [
{ address = "0.0.0.0"; prefixLength = 0; via = ifs.wan.gw4; }
];
};
${ifs.lan10.name} = {
ipv4.addresses = [ { address = ifs.lan10.addr4; prefixLength = ifs.lan10.p4Size; } ];
ipv6.addresses = [
@ -497,8 +519,10 @@ in
# peculiarity due to wan and lan20 being bridged
# TODO: figure out a less jank way to do this
iifname $ZONE_WAN_IFS ip6 saddr ${links.lanLL} icmpv6 type nd-router-advert log drop
iifname $ZONE_WAN_IFS ip6 saddr fe80::be24:11ff:fe83:d8de icmpv6 type nd-router-advert log drop
# iifname $ZONE_WAN_IFS ip6 saddr ${links.lanLL} log drop
# iifname $ZONE_LAN_IFS ip6 saddr ${links.wanLL} log drop
ip6 nexthdr icmpv6 log prefix "ICMPv6: " accept
# Allow established and related connections
# All icmp stuff should (theoretically) be handled by ct related
@ -524,7 +548,7 @@ in
iifname $ZONE_LAN_IFS jump zone_lan_input
ip6 saddr $OPNSENSE_P6 jump zone_lan_input
log
# log
}
chain forward {
@ -608,44 +632,44 @@ in
services.kea.dhcp4.enable = true;
services.kea.dhcp4.settings = {
interfaces-config.interfaces = [
ifs.lan.name
# ifs.lan.name
ifs.lan10.name
ifs.lan20.name
ifs.lan30.name
ifs.lan40.name
ifs.lan50.name
# ifs.lan20.name
# ifs.lan30.name
# ifs.lan40.name
# ifs.lan50.name
];
dhcp-ddns.enable-updates = true;
ddns-qualifying-suffix = "4.default.${ldomain}";
subnet4 = [
((mkDhcp4Subnet 1 ifs.lan) // reservations.lan.v4)
# ((mkDhcp4Subnet 1 ifs.lan) // reservations.lan.v4)
(mkDhcp4Subnet 10 ifs.lan10)
((mkDhcp4Subnet 20 ifs.lan20) // reservations.lan20.v4)
(mkDhcp4Subnet 30 ifs.lan30)
(mkDhcp4Subnet 40 ifs.lan40)
(mkDhcp4Subnet 50 ifs.lan50)
# ((mkDhcp4Subnet 20 ifs.lan20) // reservations.lan20.v4)
# (mkDhcp4Subnet 30 ifs.lan30)
# (mkDhcp4Subnet 40 ifs.lan40)
# (mkDhcp4Subnet 50 ifs.lan50)
];
};
services.kea.dhcp6.enable = true;
services.kea.dhcp6.settings = {
interfaces-config.interfaces = [
ifs.lan.name
# ifs.lan.name
ifs.lan10.name
# ifs.lan20.name # Managed by Att box
ifs.lan30.name
ifs.lan40.name
ifs.lan50.name
# ifs.lan30.name
# ifs.lan40.name
# ifs.lan50.name
];
# TODO: https://kea.readthedocs.io/en/latest/arm/ddns.html#dual-stack-environments
dhcp-ddns.enable-updates = true;
ddns-qualifying-suffix = "6.default.${ldomain}";
subnet6 = [
((mkDhcp6Subnet 1 ifs.lan) // reservations.lan.v6)
# ((mkDhcp6Subnet 1 ifs.lan) // reservations.lan.v6)
(mkDhcp6Subnet 10 ifs.lan10)
(mkDhcp6Subnet 30 ifs.lan30)
(mkDhcp6Subnet 40 ifs.lan40)
(mkDhcp6Subnet 50 ifs.lan50)
# (mkDhcp6Subnet 30 ifs.lan30)
# (mkDhcp6Subnet 40 ifs.lan40)
# (mkDhcp6Subnet 50 ifs.lan50)
];
};