blob: 8bf7cdea9651d3a42bf8c726b046d7e6106b27f4 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
|
{ ... }: let
wanInterface = "ppp0";
gponInterface = "enp3s0";
gponHost = "192.168.38.2";
gponSubnet = "192.168.38.0";
gponPrefix = 24;
lanInterface = "enp8s0f3u1";
subnet = "192.168.43.0";
prefix = 24;
host = "192.168.43.1";
leaseRangeStart = "192.168.43.100";
leaseRangeEnd = "192.168.43.254";
wapMac = "40:86:cb:d7:40:49";
wapIp = "192.168.43.2";
in {
imports = [
./wireguard.nix
./iperf3.nix
];
networking = {
nat = {
enable = true;
externalInterface = wanInterface;
internalInterfaces = [ lanInterface ];
};
interfaces = {
${lanInterface}.ipv4.addresses = [{
address = host;
prefixLength = prefix;
}];
${gponInterface}.ipv4.addresses = [{
address = gponHost;
prefixLength = gponPrefix;
}];
};
firewall = {
allowedUDPPorts = [ 53 67 ];
allowedTCPPorts = [ 53 ];
extraCommands = ''
iptables -t nat -I POSTROUTING 1 \
-s ${subnet}/${toString prefix} \
-o ${wanInterface} \
-j MASQUERADE
iptables -t mangle -A FORWARD -p tcp --tcp-flags SYN,RST SYN \
-o ${wanInterface} \
-j TCPMSS --clamp-mss-to-pmtu
iptables -t nat -I POSTROUTING 1 \
-d ${gponSubnet}/${toString gponPrefix} \
-j MASQUERADE
iptables -t mangle -A FORWARD -p tcp --tcp-flags SYN,RST SYN \
-d ${gponSubnet}/${toString gponPrefix} \
-j TCPMSS --clamp-mss-to-pmtu
'';
};
};
services.dnsmasq.settings = {
dhcp-range = [ "${leaseRangeStart},${leaseRangeEnd}" ];
dhcp-host= "${wapMac},${wapIp}";
interface = [ lanInterface ];
};
}
|
