This repository has no description
3.5 kB
151 lines
1{ lib, pkgs, ... }:
2{
3 # vodafone router drifts out of time
4 services.timesyncd.servers = [
5 "0.pool.ntp.org"
6 "1.pool.ntp.org"
7 "2.pool.ntp.org"
8 "3.pool.ntp.org"
9 ];
10 systemd.network.networks."50-et0" = {
11 matchConfig.Name = "et0";
12 DHCP = "yes";
13 linkConfig = {
14 RequiredForOnline = "routable";
15 };
16 networkConfig = {
17 IPv6AcceptRA = true;
18 IPv6Forwarding = true;
19 };
20 };
21 boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
22 boot.kernel.sysctl."net.ipv6.conf.all.forwarding" = 1;
23 systemd.network.networks."10-int0" = {
24 name = "int0";
25 address = [
26 "10.42.0.1/24"
27 "fd42:7d6a::1/64"
28 ];
29 networkConfig = {
30 IPv4Forwarding = true;
31 IPv6Forwarding = true;
32 ConfigureWithoutCarrier = true;
33 DHCPServer = "yes";
34 IPv6SendRA = true;
35 };
36 # announce ourselves (dnsmasq) as resolver, so *.gg23 resolves for clients
37 dhcpServerConfig = {
38 EmitDNS = true;
39 DNS = "_server_address";
40 EmitDomain = true;
41 Domain = "gg23";
42 };
43 ipv6SendRAConfig = {
44 EmitDNS = true;
45 DNS = [ "fd42:7d6a::1" ];
46 EmitDomains = true;
47 Domains = [ "gg23" ];
48 };
49 ipv6Prefixes = [
50 {
51 ipv6PrefixConfig = {
52 Prefix = "fd42:7d6a::/64";
53 };
54 }
55 ];
56 dhcpServerStaticLeases = [
57 {
58 # printer
59 dhcpServerStaticLeaseConfig = {
60 Address = "10.42.0.4";
61 MACAddress = "94:dd:f8:23:c5:ac";
62 };
63 }
64 {
65 # firetv
66 dhcpServerStaticLeaseConfig = {
67 Address = "10.42.0.11";
68 MACAddress = "84:28:59:f0:d2:a8";
69 };
70 }
71 # {
72 # dhcpServerStaticLeaseConfig = {
73 # Address = "10.42.0.10";
74 # MACAddress = "ea:4d:12:94:74:2a";
75 # };
76 # }
77 {
78 dhcpServerStaticLeaseConfig = {
79 Address = "10.42.0.10";
80 MACAddress = "fe:fe:fe:fe:fe:fe";
81 };
82 }
83 ];
84 };
85 networking.networkmanager.unmanaged = [ "int0" ];
86 krebs.iptables.tables.filter.INPUT.rules = [
87 {
88 predicate = "-i int0";
89 target = "ACCEPT";
90 }
91 ];
92 krebs.iptables.tables.filter.FORWARD.rules = [
93 {
94 predicate = "-i int0";
95 target = "ACCEPT";
96 }
97 {
98 predicate = "-o int0";
99 target = "ACCEPT";
100 }
101 {
102 predicate = "-p ipv6-icmp";
103 target = "ACCEPT";
104 v4 = false;
105 }
106 ];
107 krebs.iptables.tables.nat.PREROUTING.rules = lib.mkBefore [
108 {
109 v6 = false;
110 predicate = "-s 10.42.0.0/24";
111 target = "ACCEPT";
112 }
113 ];
114 krebs.iptables.tables.nat.POSTROUTING.rules = [
115 {
116 v6 = false;
117 predicate = "-s 10.42.0.0/24";
118 target = "MASQUERADE";
119 }
120 {
121 v4 = false;
122 predicate = "-s fd42:7d6a::/64";
123 target = "MASQUERADE";
124 }
125 ];
126
127 networking.domain = "gg23";
128
129 networking.useHostResolvConf = false;
130 services.resolved.settings.Resolve.DNSStubListener = "no";
131 services.dnsmasq = {
132 enable = true;
133 resolveLocalQueries = false;
134
135 settings = {
136 local = "/gg23/";
137 domain = "gg23";
138 expand-hosts = true;
139 listen-address = "10.42.0.1,10.233.0.1";
140 interface = "int0";
141 };
142 };
143
144 environment.systemPackages = [
145 (pkgs.writers.writeDashBin "restart_router" ''
146 ${pkgs.mosquitto}/bin/mosquitto_pub -h localhost -t 'cmnd/router/POWER' -u gg23 -P gg23-mqtt -m OFF
147 sleep 2
148 ${pkgs.mosquitto}/bin/mosquitto_pub -h localhost -t 'cmnd/router/POWER' -u gg23 -P gg23-mqtt -m ON
149 '')
150 ];
151}