This repository has no description
2.8 kB
82 lines
1{ config, pkgs, ... }:
2let
3 wifi = "wlp0s29u1u2";
4in {
5 boot.extraModulePackages = [
6 pkgs.linuxPackages.rtl8814au
7 ];
8 networking.networkmanager.unmanaged = [ wifi "et0" ];
9
10 systemd.services.hostapd = {
11 description = "hostapd wireless AP";
12 path = [ pkgs.hostapd ];
13 wantedBy = [ "network.target" ];
14
15 after = [ "${wifi}-cfg.service" "nat.service" "bind.service" "dhcpd.service" "sys-subsystem-net-devices-${wifi}.device" ];
16
17 serviceConfig = {
18 ExecStart = "${pkgs.hostapd}/bin/hostapd ${pkgs.writeText "hostapd.conf" ''
19 interface=${wifi}
20 hw_mode=a
21 channel=36
22 ieee80211d=1
23 country_code=DE
24 ieee80211n=1
25 ieee80211ac=1
26 wmm_enabled=1
27
28 # 5ghz
29 ssid=krebsing
30 auth_algs=1
31 wpa=2
32 wpa_key_mgmt=WPA-PSK
33 rsn_pairwise=CCMP
34 wpa_passphrase=aidsballz
35 ''}";
36 Restart = "always";
37 };
38 };
39
40 networking.bridges.br0.interfaces = [
41 wifi
42 "et0"
43 ];
44
45 networking.interfaces.br0.ipv4.addresses = [
46 { address = "10.99.0.1"; prefixLength = 24; }
47 ];
48 services.dhcpd4 = {
49 enable = true;
50 interfaces = [ "br0" ];
51 extraConfig = ''
52 option subnet-mask 255.255.255.0;
53 option routers 10.99.0.1;
54 option domain-name-servers 1.1.1.1, 8.8.8.8;
55 subnet 10.99.0.0 netmask 255.255.255.0 {
56 range 10.99.0.100 10.99.0.200;
57 }
58 '';
59 };
60
61 boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
62 krebs.iptables.tables.filter.FORWARD.rules = [
63 { v6 = false; predicate = "-d 10.99.0.0/24 -o br0 -m conntrack --ctstate RELATED,ESTABLISHED"; target = "ACCEPT"; }
64 { v6 = false; predicate = "-s 10.99.0.0/24 -i br0"; target = "ACCEPT"; }
65 { v6 = false; predicate = "-i br0 -o br0"; target = "ACCEPT"; }
66 { v6 = false; predicate = "-i br0 -o br0"; target = "ACCEPT"; }
67 { v6 = false; predicate = "-o br0"; target = "REJECT --reject-with icmp-port-unreachable"; }
68 { v6 = false; predicate = "-i br0"; target = "REJECT --reject-with icmp-port-unreachable"; }
69 ];
70 krebs.iptables.tables.nat.PREROUTING.rules = mkBefore [
71 { v6 = false; predicate = "-s 10.99.0.0/24"; target = "ACCEPT"; }
72 ];
73 krebs.iptables.tables.nat.POSTROUTING.rules = [
74 #TODO find out what this is about?
75 { v6 = false; predicate = "-s 10.99.0.0/24 -d 224.0.0.0/24"; target = "RETURN"; }
76 { v6 = false; predicate = "-s 10.99.0.0/24 -d 255.255.255.255"; target = "RETURN"; }
77
78 { v6 = false; predicate = "-s 10.99.0.0/24 ! -d 10.99.0.0/24"; target = "MASQUERADE"; }
79 { v6 = false; predicate = "-s 10.99.0.0/24 ! -d 10.99.0.0/24 -p tcp"; target = "MASQUERADE --to-ports 1024-65535"; }
80 { v6 = false; predicate = "-s 10.99.0.0/24 ! -d 10.99.0.0/24 -p udp"; target = "MASQUERADE --to-ports 1024-65535"; }
81 ];
82}