1 { pkgs, lib, config, hosts, ... }:
5 #gateway = config.networking.defaultGateway.interface;
8 environment.systemPackages = [
11 networking.interfaces.${iface} = {
12 ipv4.addresses = [ { address = "192.168.6.1"; prefixLength = 24; } ];
14 # Not merged, even though all are 1
15 #boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
16 boot.kernel.sysctl."net.ipv6.conf.${iface}.addr_gen_mode" = 1;
17 networking.nftables.ruleset = ''
20 meta l4proto { udp, tcp } th dport domain counter accept comment "DNS"
21 tcp dport bootps counter accept comment "DHCP"
24 iifname ${iface} jump input-wifi
25 iifname ${iface} log level warn prefix "input-wifi: " counter drop
32 oifname ${iface} jump output-wifi
33 oifname ${iface} log level warn prefix "output-wifi: " counter drop
37 iifname ${iface} oifname ${gateway} counter accept
38 iifname ${gateway} oifname ${iface} counter accept
43 services.unbound.settings = {
45 interface = [ "192.168.6.1" ];
46 access-control = ["192.168.6.0/24 allow"];
48 "tracking.intl.miui.com always_refuse"
49 "sourcephile.fr typetransparent"
52 "\"bureau1.sourcephile.fr A 192.168.6.1\""
57 networking.wlanInterfaces.${iface} = {
62 networking.networkmanager.unmanaged = [
64 "interface-name:${iface}"
68 # iw dev wlp4s0 station dump
69 # DOC: https://w1.fi/cgit/hostap/plain/hostapd/hostapd.conf
77 wpaPassphrase = "bidonpoissonmaisonronron";
82 dtim_period=2 # DTIM (delivery trafic information message)
84 # limit the frequencies used to those allowed in the country
86 # 0 means the AP will search for the channel with the least interferences (ACS)
93 auth_algs=1 # 0=noauth, 1=wpa, 2=wep, 3=both
95 # QoS support, also required for full speed on 802.11n/ac/ax
97 eap_reauth_period=360000
104 # See Capabilities in iw list
105 ht_capab=[HT40+][SHORT-GI-40][DSSS_CCK-40][MAX-AMSDU-7935]
113 systemd.services."dhcpd4" = {
114 after = [ "network-addresses-${iface}.service" ];
116 "network-addresses-${iface}.service"
117 "sys-subsystem-net-devices-${iface}.device"
122 interfaces = [ iface ];
124 option subnet-mask 255.255.255.0;
125 option broadcast-address 192.168.6.255;
126 option routers 192.168.6.1;
127 option domain-name-servers 192.168.6.1;
128 subnet 192.168.6.0 netmask 255.255.255.0 {
129 range 192.168.6.100 192.168.6.200;
134 #networking.firewall.allowedUDPPorts = [ 53 67 ]; # DNS & DHCP
136 # Sometimes slow connection speeds are attributed to absence of haveged.
137 services.haveged.enable = true;
142 systemd.services.wifi-relay = let inherit (pkgs) iptables gnugrep;
144 description = "iptables rules for wifi-relay";
145 after = [ "dhcpd4.service" ];
146 wantedBy = [ "multi-user.target" ];
148 ${iptables}/bin/iptables -w -t nat -I POSTROUTING -s 192.168.6.0/24 ! -o wlan-ap0 -j MASQUERADE
149 ${iptables}/bin/iptables -w -I FORWARD -i wlan-ap0 -s 192.168.6.0/24 -j ACCEPT
150 ${iptables}/bin/iptables -w -I FORWARD -i wlan-station0 -d 192.168.6.0/24 -j ACCEPT