This repository has no description
3.1 kB
143 lines
1{ pkgs, ... }:
2let
3 wifi = "wlp0s29u1u2";
4in
5{
6 boot.extraModulePackages = [
7 pkgs.linuxPackages.rtl8814au
8 ];
9 networking.networkmanager.unmanaged = [
10 wifi
11 "et0"
12 ];
13
14 systemd.services.hostapd = {
15 description = "hostapd wireless AP";
16 path = [ pkgs.hostapd ];
17 wantedBy = [ "network.target" ];
18
19 after = [
20 "${wifi}-cfg.service"
21 "nat.service"
22 "bind.service"
23 "dhcpd.service"
24 "sys-subsystem-net-devices-${wifi}.device"
25 ];
26
27 serviceConfig = {
28 ExecStart = "${pkgs.hostapd}/bin/hostapd ${pkgs.writeText "hostapd.conf" ''
29 interface=${wifi}
30 hw_mode=a
31 channel=36
32 ieee80211d=1
33 country_code=DE
34 ieee80211n=1
35 ieee80211ac=1
36 wmm_enabled=1
37
38 # 5ghz
39 ssid=krebsing
40 auth_algs=1
41 wpa=2
42 wpa_key_mgmt=WPA-PSK
43 rsn_pairwise=CCMP
44 wpa_passphrase=aidsballz
45 ''}";
46 Restart = "always";
47 };
48 };
49
50 networking.bridges.br0.interfaces = [
51 wifi
52 "et0"
53 ];
54
55 networking.interfaces.br0.ipv4.addresses = [
56 {
57 address = "10.99.0.1";
58 prefixLength = 24;
59 }
60 ];
61 services.dhcpd4 = {
62 enable = true;
63 interfaces = [ "br0" ];
64 extraConfig = ''
65 option subnet-mask 255.255.255.0;
66 option routers 10.99.0.1;
67 option domain-name-servers 1.1.1.1, 8.8.8.8;
68 subnet 10.99.0.0 netmask 255.255.255.0 {
69 range 10.99.0.100 10.99.0.200;
70 }
71 '';
72 };
73
74 boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
75 krebs.iptables.tables.filter.FORWARD.rules = [
76 {
77 v6 = false;
78 predicate = "-d 10.99.0.0/24 -o br0 -m conntrack --ctstate RELATED,ESTABLISHED";
79 target = "ACCEPT";
80 }
81 {
82 v6 = false;
83 predicate = "-s 10.99.0.0/24 -i br0";
84 target = "ACCEPT";
85 }
86 {
87 v6 = false;
88 predicate = "-i br0 -o br0";
89 target = "ACCEPT";
90 }
91 {
92 v6 = false;
93 predicate = "-i br0 -o br0";
94 target = "ACCEPT";
95 }
96 {
97 v6 = false;
98 predicate = "-o br0";
99 target = "REJECT --reject-with icmp-port-unreachable";
100 }
101 {
102 v6 = false;
103 predicate = "-i br0";
104 target = "REJECT --reject-with icmp-port-unreachable";
105 }
106 ];
107 krebs.iptables.tables.nat.PREROUTING.rules = mkBefore [
108 {
109 v6 = false;
110 predicate = "-s 10.99.0.0/24";
111 target = "ACCEPT";
112 }
113 ];
114 krebs.iptables.tables.nat.POSTROUTING.rules = [
115 #TODO find out what this is about?
116 {
117 v6 = false;
118 predicate = "-s 10.99.0.0/24 -d 224.0.0.0/24";
119 target = "RETURN";
120 }
121 {
122 v6 = false;
123 predicate = "-s 10.99.0.0/24 -d 255.255.255.255";
124 target = "RETURN";
125 }
126
127 {
128 v6 = false;
129 predicate = "-s 10.99.0.0/24 ! -d 10.99.0.0/24";
130 target = "MASQUERADE";
131 }
132 {
133 v6 = false;
134 predicate = "-s 10.99.0.0/24 ! -d 10.99.0.0/24 -p tcp";
135 target = "MASQUERADE --to-ports 1024-65535";
136 }
137 {
138 v6 = false;
139 predicate = "-s 10.99.0.0/24 ! -d 10.99.0.0/24 -p udp";
140 target = "MASQUERADE --to-ports 1024-65535";
141 }
142 ];
143}