hosts/aubergine/networking.nix

   1 { config, pkgs, lib, hostName, ... }:
   2 let
   3   wifiIface = "wlp5s0";
   4   wwanIface = "wwp0s19u1u3i3"; # usb_modeswitch -W -v 12d1 -p 1573 -u 1
   5   ftthIface = "enp1s0";
   6   eth1Iface = "enp2s0";
   7   eth2Iface = "enp3s0";
   8   eth3Iface = "enp4s0";
   9   wifiIPv4 = "192.168.5";
  10   eth1IPv4 = "192.168.2";
  11   eth2IPv4 = "192.168.3";
  12   eth3IPv4 = "192.168.4";
  13 in
  14 {
  15 imports = [
  16   networking/nftables.nix
  17   ../../nixos/profiles/networking.nix
  18   ../../nixos/profiles/dnscrypt-proxy2.nix
  19   ../../nixos/profiles/wireguard/wg-intra.nix
  20 ];
  21 install.substituteOnDestination = false;
  22 networking.domain = "sourcephile.fr";
  23 networking.useDHCP = false;
  24
  25 boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
  26 networking.nftables.ruleset = lib.mkAfter ''
  27   table inet filter {
  28     chain input {
  29       iifname { ${wwanIface}, ${ftthIface} } jump input-net
  30       iifname { ${wwanIface}, ${ftthIface} } log level warn prefix "input-net: " counter drop
  31
  32       iifname { ${wifiIface}, ${eth1Iface}, ${eth2Iface}, ${eth3Iface} } jump input-lan
  33       iifname { ${wifiIface}, ${eth1Iface}, ${eth2Iface}, ${eth3Iface} } log level warn prefix "input-lan: " counter drop
  34     }
  35     chain output {
  36       oifname { ${wwanIface}, ${ftthIface} } jump output-net
  37       oifname { ${wwanIface}, ${ftthIface} } log level warn prefix "output-net: " counter drop
  38
  39       oifname { ${wifiIface}, ${eth1Iface}, ${eth2Iface}, ${eth3Iface} } jump output-lan
  40       oifname { ${wifiIface}, ${eth1Iface}, ${eth2Iface}, ${eth3Iface} } log level warn prefix "output-lan: " counter drop
  41     }
  42     chain forward-to-net {
  43       #jump forward-connectivity
  44       counter accept
  45     }
  46     chain forward-from-net {
  47       ct state { established, related } accept
  48       log level warn prefix "forward-from-net: " counter drop
  49     }
  50     chain forward {
  51       iifname { ${wifiIface}, ${eth1Iface}, ${eth2Iface}, ${eth3Iface} } oifname { ${wwanIface}, ${ftthIface} } goto forward-to-net
  52       iifname { ${wwanIface}, ${ftthIface} } oifname { ${wifiIface}, ${eth1Iface}, ${eth2Iface}, ${eth3Iface} } goto forward-from-net
  53       log level warn prefix "forward: " counter drop
  54     }
  55   }
  56   table inet nat {
  57     chain postrouting {
  58       iifname { ${wifiIface}, ${eth1Iface}, ${eth2Iface}, ${eth3Iface} } oifname { ${wwanIface}, ${ftthIface} } masquerade
  59     }
  60   }
  61 '';
  62
  63 services.avahi.openFirewall = true;
  64 services.dnscrypt-proxy2.settings.listen_addresses = [
  65   "127.0.0.1:53"
  66   "[::1]:53"
  67   "${wifiIPv4}.1:53"
  68   "${eth1IPv4}.1:53"
  69   "${eth2IPv4}.1:53"
  70   "${eth3IPv4}.1:53"
  71 ];
  72 networking.interfaces = {
  73   ${ftthIface} = {
  74     useDHCP = false;
  75   };
  76   ${wifiIface} = {
  77     useDHCP = false;
  78     ipv4.addresses = [ { address = "${wifiIPv4}.1"; prefixLength = 24; } ];
  79     ipv4.routes = [ { address = "${wifiIPv4}.0"; prefixLength = 24; options = { congctl="westwood";}; } ];
  80   };
  81   ${eth1Iface} = {
  82     useDHCP = false;
  83     ipv4.addresses = [ { address = "${eth1IPv4}.1"; prefixLength = 24; } ];
  84   };
  85   ${eth2Iface} = {
  86     useDHCP = false;
  87     ipv4.addresses = [ { address = "${eth2IPv4}.1"; prefixLength = 24; } ];
  88   };
  89   ${eth3Iface} = {
  90     useDHCP = false;
  91     ipv4.addresses = [ { address = "${eth3IPv4}.1"; prefixLength = 24; } ];
  92   };
  93 };
  94
  95
  96 systemd.services.dhcpd4 = {
  97   onFailure = [
  98     "network-addresses-${wifiIface}.service"
  99     "network-addresses-${eth1Iface}.service"
 100     "network-addresses-${eth2Iface}.service"
 101     "network-addresses-${eth3Iface}.service"
 102   ];
 103 };
 104 services.dhcpd4 = {
 105   enable = true;
 106   interfaces = [
 107     wifiIface
 108     eth1Iface
 109     eth2Iface
 110     eth3Iface
 111   ];
 112   extraConfig = ''
 113     subnet ${wifiIPv4}.0 netmask 255.255.255.0 {
 114       range ${wifiIPv4}.100 ${wifiIPv4}.200;
 115       option broadcast-address ${wifiIPv4}.255;
 116       option domain-name-servers ${wifiIPv4}.1;
 117       option routers ${wifiIPv4}.1;
 118       option subnet-mask 255.255.255.0;
 119     }
 120
 121     subnet ${eth1IPv4}.0 netmask 255.255.255.0 {
 122       range ${eth1IPv4}.100 ${eth1IPv4}.200;
 123       option broadcast-address ${eth1IPv4}.255;
 124       option domain-name-servers ${eth1IPv4}.1;
 125       option routers ${eth1IPv4}.1;
 126       option subnet-mask 255.255.255.0;
 127     }
 128
 129     subnet ${eth2IPv4}.0 netmask 255.255.255.0 {
 130       range ${eth2IPv4}.100 ${eth2IPv4}.200;
 131       option broadcast-address ${eth2IPv4}.255;
 132       option domain-name-servers ${eth2IPv4}.1;
 133       option routers ${eth2IPv4}.1;
 134       option subnet-mask 255.255.255.0;
 135     }
 136
 137     subnet ${eth3IPv4}.0 netmask 255.255.255.0 {
 138       range ${eth3IPv4}.100 ${eth3IPv4}.200;
 139       option broadcast-address ${eth3IPv4}.255;
 140       option domain-name-servers ${eth3IPv4}.1;
 141       option routers ${eth3IPv4}.1;
 142       option subnet-mask 255.255.255.0;
 143     }
 144   '';
 145 };
 146
 147 systemd.services.NetworkManager.wants = [ "ModemManager.service" ];
 148 networking.networkmanager = {
 149   #enable = true;
 150   unmanaged = [
 151     ftthIface
 152     wifiIface
 153     eth1Iface
 154     eth2Iface
 155     eth3Iface
 156   ];
 157 };
 158 environment.etc."NetworkManager/system-connections/Prixtel.nmconnection" = {
 159   mode = "600";
 160   text = ''
 161     [connection]
 162     id=Prixtel
 163     uuid=b223f550-dff1-4ba3-9755-cd4557faaa5a
 164     type=gsm
 165     autoconnect=true
 166     permissions=user:julm:;
 167
 168     [gsm]
 169     apn=sl2sfr
 170     number=*99#
 171     #home-only=true
 172
 173     [ppp]
 174
 175     [ipv4]
 176     method=auto
 177     dhcp-send-hostname=false
 178
 179     [ipv6]
 180     method=auto
 181     addr-gen-mode=stable-privacy
 182     ip6-privacy=2
 183     dhcp-send-hostname=false
 184
 185     [proxy]
 186   '';
 187 };
 188
 189 networking.wireguard.wg-intra.peers = {
 190   mermet.enable = true;
 191   losurdo.enable = true;
 192   oignon.enable = true;
 193   patate.enable = true;
 194 };
 195
 196 services.openssh.listenAddresses = [
 197   { addr = "${wifiIPv4}.1"; port = 22; }
 198   { addr = "${eth1IPv4}.1"; port = 22; }
 199   { addr = "${eth2IPv4}.1"; port = 22; }
 200   { addr = "${eth3IPv4}.1"; port = 22; }
 201 ];
 202
 203 environment.systemPackages = [
 204   pkgs.iw
 205   pkgs.modem-manager-gui
 206   pkgs.libmbim
 207   pkgs.chatty
 208   pkgs.calls
 209   # https://gitlab.com/mobian1/callaudiod/-/issues/26
 210   # https://gitlab.com/mobian1/callaudiod/-/issues/27
 211   pkgs.callaudiod
 212 ];
 213
 214 # iw dev wlp5s0 station dump
 215 # DOC: https://w1.fi/cgit/hostap/plain/hostapd/hostapd.conf
 216 services.hostapd = {
 217   enable = true;
 218   logLevel = 2;
 219   interface = wifiIface;
 220   # 0 means the AP will search for the channel with the least interferences (ACS)
 221   channel = 1;
 222   hwMode = "g";
 223   ssid = hostName;
 224   wpa = false;
 225   #wpaPassphrase = "bidonpoissonmaisonronron";
 226   countryCode = "FR";
 227   extraConfig = ''
 228     # WLAN
 229     beacon_int=100
 230     dtim_period=2 # DTIM (delivery trafic information message)
 231     preamble=1
 232     # limit the frequencies used to those allowed in the country
 233     ieee80211d=1
 234
 235     # WPA2
 236     #wpa_key_mgmt=WPA-PSK
 237     #wpa_pairwise=CCMP
 238     #rsn_pairwise=CCMP
 239     #auth_algs=1 # 0=noauth, 1=wpa, 2=wep, 3=both
 240     macaddr_acl=0
 241     # QoS support, also required for full speed on 802.11n/ac/ax
 242     wmm_enabled=1
 243     eap_reauth_period=360000
 244     wpa_group_rekey=600
 245     wpa_ptk_rekey=600
 246     wpa_gmk_rekey=86400
 247
 248     # N-WLAN
 249     ieee80211n=1
 250     # See Capabilities in iw list
 251     #ht_capab=[HT40+][SHORT-GI-40][DSSS_CCK-40][MAX-AMSDU-3839]
 252     require_ht=1
 253     obss_interval=0
 254
 255     # 802.11ac support
 256     ieee80211ac=0
 257   '';
 258 };
 259 }