blob: 64c653cc8c49670c3048bbf3e7124511e52f6201 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
|
{ ... }: let
wanInterface = "ppp0";
gponInterface = "enp3s0";
gponHost = "192.168.38.2";
gponPrefix = 24;
lanInterface = "enp8s0f3u1";
subnet = "10.0.0.0";
prefix = 24;
host = "10.0.0.1";
leaseRangeStart = "10.0.0.100";
leaseRangeEnd = "10.0.0.254";
in {
imports = [
./wireguard.nix
./iperf3.nix
];
networking = {
nat = {
enable = true;
externalInterface = wanInterface;
internalInterfaces = [ lanInterface ];
};
interfaces = {
${lanInterface}.ipv4.addresses = [{
address = host;
prefixLength = prefix;
}];
${gponInterface}.ipv4.addresses = [{
address = gponHost;
prefixLength = gponPrefix;
}];
};
firewall = {
allowedUDPPorts = [ 53 67 ];
allowedTCPPorts = [ 53 ];
extraCommands = ''
iptables -t nat -I POSTROUTING 1 \
-s ${subnet}/${toString prefix} \
-o ${wanInterface} \
-j MASQUERADE
iptables -t mangle -A FORWARD -p tcp --tcp-flags SYN,RST SYN \
-o ${wanInterface} \
-j TCPMSS --clamp-mss-to-pmtu
iptables -t nat -I POSTROUTING 1 \
-s ${subnet}/${toString prefix} \
-o ${gponInterface} \
-j MASQUERADE
iptables -t mangle -A FORWARD -p tcp --tcp-flags SYN,RST SYN \
-o ${gponInterface} \
-j TCPMSS --clamp-mss-to-pmtu
'';
};
};
services.dnsmasq.settings = {
dhcp-range = [ "${leaseRangeStart},${leaseRangeEnd}" ];
interface = [ lanInterface ];
};
}
|
