This repository has no description
1.3 kB
44 lines
1{ config, lib, pkgs, ... }:
2{
3 # Bridge interface for containers
4 systemd.network.netdevs."10-ctr0" = {
5 netdevConfig = {
6 Kind = "bridge";
7 Name = "ctr0";
8 };
9 };
10
11 systemd.network.networks."10-ctr0" = {
12 matchConfig.Name = "ctr0";
13 address = [ "fd00:ctr::1/64" ];
14 networkConfig.ConfigureWithoutCarrier = true;
15 };
16
17 # Exclude from NetworkManager
18 networking.networkmanager.unmanaged = [ "ctr0" ];
19
20 # IPv6 forwarding
21 boot.kernel.sysctl."net.ipv6.conf.all.forwarding" = 1;
22
23 # Jool NAT64 kernel module
24 boot.extraModulePackages = [ config.boot.kernelPackages.jool ];
25 boot.kernelModules = [ "jool" ];
26
27 systemd.services.jool = {
28 description = "Jool NAT64";
29 after = [ "network.target" ];
30 wantedBy = [ "multi-user.target" ];
31 serviceConfig = {
32 Type = "oneshot";
33 RemainAfterExit = true;
34 ExecStart = "${pkgs.jool-cli}/bin/jool instance add --netfilter --pool6 64:ff9b::/96";
35 ExecStop = "${pkgs.jool-cli}/bin/jool instance remove";
36 };
37 };
38
39 # Firewall rules for container bridge
40 krebs.iptables.tables.filter.FORWARD.rules = [
41 { v6 = true; predicate = "-i ctr0"; target = "ACCEPT"; }
42 { v6 = true; predicate = "-o ctr0 -m conntrack --ctstate RELATED,ESTABLISHED"; target = "ACCEPT"; }
43 ];
44}