blob: 7cd3763d6741f0edaac2f0315b35d0fbe1e01579 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
|
{ lib, pkgs, ... }: let
wanInterface = "ppp0";
wanMTU = 1492;
gponInterface = "enp3s0";
gponHost = "192.168.38.1";
gponPrefix = 24;
lanInterface = "enp8s0f3u1";
subnet = "192.168.43.0";
prefix = 24;
host = "192.168.43.1";
leaseRangeStart = "192.168.43.100";
leaseRangeEnd = "192.168.43.254";
wapMac = "40:86:cb:d7:40:49";
wapIp = "192.168.43.2";
in {
imports = [
./wireguard.nix
./iperf3.nix
];
networking = {
nat = {
enable = true;
externalInterface = wanInterface;
internalInterfaces = [ lanInterface ];
};
interfaces = {
${lanInterface}.ipv4.addresses = [{
address = host;
prefixLength = prefix;
}];
${gponInterface}.ipv4.addresses = [{
address = gponHost;
prefixLength = gponPrefix;
}];
# TODO: fix it upstream
# https://github.com/NixOS/nixpkgs/blob/e8c38b73aeb218e27163376a2d617e61a2ad9b59/nixos/modules/services/networking/dhcpcd.nix#L13
# without this dhcpcd will not run, and if we set it to wanInterface,
# when pppd(ppp0 iface) exit it'll take out wan vlan iface as well
${wanInterface}.useDHCP = true;
};
firewall = {
allowedUDPPorts = [ 53 67 ];
allowedTCPPorts = [ 53 ];
extraCommands = ''
iptables -t nat -I POSTROUTING 1 \
-s ${subnet}/${toString prefix} \
-o ${wanInterface} \
-j MASQUERADE
iptables -t mangle -A FORWARD -p tcp --tcp-flags SYN,RST SYN \
-o ${wanInterface} \
-j TCPMSS --clamp-mss-to-pmtu
'';
};
};
services.dnsmasq.settings = {
dhcp-range = [ "${leaseRangeStart},${leaseRangeEnd}" ];
dhcp-host = "${wapMac},${wapIp}";
interface = [ lanInterface ];
};
boot.kernel.sysctl."net.ipv6.conf.all.forwarding" = 2;
networking.dhcpcd = {
allowInterfaces = [ wanInterface ];
IPv6rs = false;
wait = "ipv6";
extraConfig = ''
ipv6only
interface ${wanInterface}
ipv6rs
ia_pd 1 ${lanInterface}/0
'';
};
# we start the services using pppd script
systemd.services = {
dhcpcd = {
before = lib.mkForce [];
wants = lib.mkForce [];
wantedBy = lib.mkForce [];
};
radvd = {
after = lib.mkForce [];
requires = lib.mkForce[];
wantedBy = lib.mkForce [];
};
};
services = {
pppd.script."ipv6" = {
runtimeInputs = [ pkgs.systemd pkgs.gnugrep pkgs.iproute2 ];
text = ''
systemctl restart dhcpcd.service
systemctl restart radvd.service
'';
};
radvd = {
enable = lib.mkForce true;
config = ''
interface ${lanInterface} {
AdvSendAdvert on;
AdvDefaultPreference high;
AdvLinkMTU ${toString wanMTU};
MinRtrAdvInterval 3;
MaxRtrAdvInterval 6;
AdvDefaultLifetime 60;
prefix ::/64 {
AdvPreferredLifetime 30;
AdvValidLifetime 60;
};
};
'';
};
};
}
|
