WIP: router: bring back lan10

flake.lock

@@ -7,11 +7,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1742957044,
+        "lastModified": 1741791118,
-        "narHash": "sha256-gwW0tBIA77g6qq45y220drTy0DmThF3fJMwVFUtYV9c=",
+        "narHash": "sha256-4Y427uj0eql4yRU5rely3EcOlB9q457UDbG9omPtXiA=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "ce287a5cd3ef78203bc78021447f937a988d9f6f",
+        "rev": "18780912345970e5b546b1b085385789b6935a83",
         "type": "github"
       },
       "original": {
@@ -43,11 +43,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1742568034,
+        "lastModified": 1740947705,
-        "narHash": "sha256-QaMEhcnscfF2MqB7flZr+sLJMMYZPnvqO4NYf9B4G38=",
+        "narHash": "sha256-Co2kAD2SZalOm+5zoxmzEVZNvZ17TyafuFsD46BwSdY=",
         "owner": "nix-community",
         "repo": "nixos-generators",
-        "rev": "42ee229088490e3777ed7d1162cb9e9d8c3dbb11",
+        "rev": "507911df8c35939050ae324caccc7cf4ffb76565",
         "type": "github"
       },
       "original": {
@@ -58,11 +58,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1742669843,
+        "lastModified": 1741513245,
-        "narHash": "sha256-G5n+FOXLXcRx+3hCJ6Rt6ZQyF1zqQ0DL0sWAMn2Nk0w=",
+        "narHash": "sha256-7rTAMNTY1xoBwz0h7ZMtEcd8LELk9R5TzBPoHuhNSCk=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "1e5b653dff12029333a6546c11e108ede13052eb",
+        "rev": "e3e32b642a31e6714ec1b712de8c91a3352ce7e1",
         "type": "github"
       },
       "original": {
@@ -82,11 +82,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1742765550,
+        "lastModified": 1740569341,
-        "narHash": "sha256-2vVIh2JrL6GAGfgCeY9e6iNKrBjs0Hw3bGQEAbwVs68=",
+        "narHash": "sha256-WV8nY2IOfWdzBF5syVgCcgOchg/qQtpYh6LECYS9XkY=",
         "owner": "nix-community",
         "repo": "plasma-manager",
-        "rev": "b70be387276e632fe51232887f9e04e2b6ef8c16",
+        "rev": "5eeb0172fb74392053b66a8149e61b5e191b2845",
         "type": "github"
       },
       "original": {

hosts/router/dns.nix

@@ -46,15 +46,7 @@ in
     dns = {
       bootstrap_dns = [ "1.1.1.1" "9.9.9.9" ];
       upstream_dns = [
-        # Default upstreams
+        "quic://p0.freedns.controld.com"  # Default upstream
-        "quic://p0.freedns.controld.com"
-        "tls://one.one.one.one"
-        "tls://dns.quad9.net"
-
-        # Adguard uses upstream and not rewrite rules to resolve cname rewrites,
-        # and obviously my sysdomain entries don't exist in cloudflare.
-        "[/${sysdomain}/][::1]"           # Sys domains to self (for cname rewrites)
-
         "[/${ldomain}/][::1]:1053"        # Local domains to Knot (ddns)
         "[/home/][${ifs.lan.ulaPrefix}::250]"  # .home domains to opnsense (temporary)
       ];
@@ -64,30 +56,26 @@ in
       # DNS rewrites
       "|grouter.${domain}^$dnsrewrite=${ifs.lan.ulaAddr}"
       "|pve-1.${sysdomain}^$dnsrewrite=${ifs.lan.p4}.5"
-      "|pve-1.${sysdomain}^$dnsrewrite=${ifs.lan.ulaPrefix}::5:1"
       "|pve-3.${sysdomain}^$dnsrewrite=${ifs.lan.p4}.7"
+      "|pve-1.${sysdomain}^$dnsrewrite=${ifs.lan.ulaPrefix}::5:1"
       "|pve-3.${sysdomain}^$dnsrewrite=${ifs.lan.ulaPrefix}::7:1"
-      "|truenas.${sysdomain}^$dnsrewrite=${ifs.lan.p4}.10"
-      "|truenas.${sysdomain}^$dnsrewrite=${ifs.lan.ulaPrefix}::20d0:43ff:fec6:3192"
-      "|debbi.${sysdomain}^$dnsrewrite=${ifs.lan.p4}.11"
-      "|debbi.${sysdomain}^$dnsrewrite=${ifs.lan.ulaPrefix}::11:1"
-      "|etappi.${sysdomain}^$dnsrewrite=${ifs.lan.p4}.12"
-      "|etappi.${sysdomain}^$dnsrewrite=${ifs.lan.ulaPrefix}::12:1"
 
-      # Lab DNS rewrites
+      "||lab.${domain}^$dnsrewrite=${ifs.lan.p6}::12:1"
-      "||lab.${domain}^$dnsrewrite=etappi.${sysdomain}"
+      "||lab.${domain}^$dnsrewrite=${ifs.lan.p4}.12"
 
       # Allowed exceptions
       "@@||googleads.g.doubleclick.net"
     ]
       # Alpina DNS rewrites
-      ++ map (host: "${host}${domain}^$dnsrewrite=debbi.${sysdomain}") alpinaDomains;
+      ++ map (host: "${host}${domain}^$dnsrewrite=${ifs.lan.p6}:1cd5:56ff:feec:c74a") alpinaDomains
+      ++ map (host: "${host}${domain}^$dnsrewrite=${ifs.lan.p4}.11") alpinaDomains;
   };
 
   services.knot.enable = true;
   services.knot.settings = {
     # server.listen = "0.0.0.0@1053";
     server.listen = "::1@1053";
+    # TODO: templates
     zone = [
       {
         domain = ldomain;

hosts/router/firewall.nix

@@ -1,6 +1,9 @@
 { config, lib, pkgs, ... }:
 let
   vars = import ./vars.nix;
+  domain = vars.domain;
+  ldomain = vars.ldomain;
+  sysdomain = vars.sysdomain;
   links = vars.links;
   ifs = vars.ifs;
   pdFromWan = vars.pdFromWan;
@@ -20,23 +23,8 @@ in
           ${ifs.lan40.name},
           ${ifs.lan50.name},
       }
-      define OPNSENSE_NET6 = ${pdFromWan}d::/64
+      define OPNSENSE_P6 = ${pdFromWan}d::/64
-      define ZONE_LAN_EXTRA_NET6 = {
-          ${ifs.lan20.net6},  # needed since packets can come in from wan on these addrs
-          $OPNSENSE_NET6,
-      }
       define RFC1918 = { 10.0.0.0/8, 172.12.0.0/12, 192.168.0.0/16 }
-      define CLOUDFLARE_NET6 = {
-          # https://www.cloudflare.com/ips-v6
-          # TODO: figure out a better way to get addrs dynamically from url
-          2400:cb00::/32,
-          2606:4700::/32,
-          2803:f800::/32,
-          2405:b500::/32,
-          2405:8100::/32,
-          2a06:98c0::/29,
-          2c0f:f248::/32,
-      }
 
       define ALLOWED_TCP_PORTS = { ssh, https }
       define ALLOWED_UDP_PORTS = { bootps, dhcpv6-server, domain }
@@ -49,12 +37,9 @@ in
       }
       set port_forward_v6 {
           type inet_proto . ipv6_addr . inet_service
-          # elements = {}
-      }
-      set cloudflare_forward_v6 {
-          type ipv6_addr
           elements = {
-              ${ifs.lan.p6}::11:1,
+              tcp . ${ifs.lan.p6}::11:1 . https,
+              tcp . ${ifs.lan.p6}:1cd5:56ff:feec:c74a . https,
           }
       }
 
@@ -64,9 +49,7 @@ in
           # Drop router adverts from self
           # peculiarity due to wan and lan20 being bridged
           # TODO: figure out a less jank way to do this
-          iifname $ZONE_WAN_IFS ip6 saddr ${links.lanLL} icmpv6 type nd-router-advert log prefix "self radvt: " drop
+          iifname $ZONE_WAN_IFS ip6 saddr ${links.lanLL} icmpv6 type nd-router-advert log drop
-          # iifname $ZONE_WAN_IFS ip6 saddr ${links.lanLL} ip6 nexthdr icmpv6 log prefix "self icmpv6: " drop
-          # iifname $ZONE_WAN_IFS ip6 saddr ${links.lanLL} log prefix "self llv6: " drop
           # iifname $ZONE_WAN_IFS ip6 saddr ${links.lanLL} log drop
           # iifname $ZONE_LAN_IFS ip6 saddr ${links.wanLL} log drop
 
@@ -84,19 +67,17 @@ in
           # Allow all traffic from loopback interface
           iif lo accept
 
-          # Allow DHCPv6 traffic
+          # Allow DHCPv6 client traffic
-          # I thought dhcpv6-client traffic would be accepted by established/related,
+          ip6 daddr { fe80::/10, ff02::/16 } th dport dhcpv6-server accept
-          # but apparently not.
-          ip6 daddr { fe80::/10, ff02::/16 } th dport { dhcpv6-client, dhcpv6-server } accept
 
           # WAN zone input rules
           iifname $ZONE_WAN_IFS jump zone_wan_input
           # LAN zone input rules
           iifname $ZONE_LAN_IFS accept
           iifname $ZONE_LAN_IFS jump zone_lan_input
-          ip6 saddr $ZONE_LAN_EXTRA_NET6 jump zone_lan_input
+          ip6 saddr $OPNSENSE_P6 jump zone_lan_input
 
-          # log
+          log
       }
 
       chain forward {
@@ -109,7 +90,7 @@ in
           iifname $ZONE_WAN_IFS jump zone_wan_forward
           # LAN zone forward rules
           iifname $ZONE_LAN_IFS jump zone_lan_forward
-          ip6 saddr $ZONE_LAN_EXTRA_NET6 jump zone_lan_forward
+          ip6 saddr $OPNSENSE_P6 jump zone_lan_forward
       }
 
       chain zone_wan_input {
@@ -123,9 +104,6 @@ in
 
           # Allowed IPv6 ports
           meta l4proto . ip6 daddr . th dport @port_forward_v6 accept
-
-          # Allowed IPv6 from cloudflare
-          ip6 saddr $CLOUDFLARE_NET6 ip6 daddr @cloudflare_forward_v6 accept
       }
 
       chain zone_lan_input {

hosts/router/ifconfig.nix

@@ -54,15 +54,20 @@ in
   networking.dhcpcd.enable = true;
   networking.dhcpcd.allowInterfaces = [ ifs.wan.name ];
   networking.dhcpcd.extraConfig = ''
-    debug
     nohook resolv.conf, yp, hostname, ntp
 
     interface ${ifs.wan.name}
-      ipv6only
+      # IPv4 (Static)
+      nodhcp
+      noipv4ll
+      static ip_address=${ifs.wan.addr4Sized}
+      static routers=${ifs.wan.gw4}
+
+      # IPv6
       duid
       ipv6rs
       dhcp6
-      # option rapid_commit
+      option rapid_commit
 
       # DHCPv6 addr
       ia_na
@@ -121,20 +126,10 @@ in
     networks = {
       "10-wan" = {
         matchConfig.Name = ifs.wan.name;
-        # make routing on this interface a dependency for network-online.target
+        linkConfig = {
-        linkConfig.RequiredForOnline = "routable";
+          Unmanaged = true;
-        networkConfig = {
+          RequiredForOnline = "routable";
-          # start a DHCP Client for IPv4 Addressing/Routing
-          # DHCP = "ipv4";
-          # accept Router Advertisements for Stateless IPv6 Autoconfiguraton (SLAAC)
-          # let dhcpcd handle this
-          Address = [ ifs.wan.addr4Sized ];
-          IPv6AcceptRA = false;
-          KeepConfiguration = true;
         };
-        routes = [
-          { Gateway = ifs.wan.gw4; }
-        ];
       };
       "20-lan" = (mkLanConfig ifs.lan) // {
         vlan = [