]> Git — Sourcephile - julm/julm-nix.git/blob - hosts/aubergine/networking/wifi.nix
aubergine: wifi: enable WPA and do not broadcast SSID
[julm/julm-nix.git] / hosts / aubergine / networking / wifi.nix
1 { pkgs, lib, hostName, ... }:
2 with (import ./names-and-numbers.nix);
3 with (import ./names-and-numbers.nix.clear);
4 {
5 imports = [
6 ../../../nixos/profiles/networking/wifi.nix
7 ];
8 networking.interfaces = {
9 ${wifiIface} = {
10 useDHCP = false;
11 ipv4.addresses = [{ address = "${wifiIPv4}.1"; prefixLength = 24; }];
12 ipv4.routes = [
13 {
14 address = "${wifiIPv4}.0";
15 prefixLength = 24;
16 options = { congctl = "westwood"; };
17 }
18 ];
19 };
20 };
21 networking.nftables.ruleset = lib.mkAfter ''
22 table inet filter {
23 chain input {
24 iifname ${wifiIface} jump input-lan
25 iifname ${wifiIface} log level warn prefix "input-lan: " counter drop
26 }
27 chain output {
28 oifname ${wifiIface} jump output-lan
29 oifname ${wifiIface} log level warn prefix "output-lan: " counter drop
30 }
31 chain forward-to-wifi {
32 accept
33 }
34 chain forward-from-wifi {
35 accept
36 }
37 chain forward {
38 iifname { ${eth1Iface}, ${eth2Iface}, ${eth3Iface} } oifname ${wifiIface} goto forward-to-wifi
39 iifname ${wifiIface} oifname { ${eth1Iface}, ${eth2Iface}, ${eth3Iface} } goto forward-from-wifi
40 }
41 }
42 '';
43
44 networking.networkmanager.unmanaged = [ wifiIface ];
45 systemd.services.dhcpd4.onFailure = [ "network-addresses-${wifiIface}.service" ];
46 services.dhcpd4 = {
47 enable = true;
48 interfaces = [ wifiIface ];
49 extraConfig = ''
50 subnet ${wifiIPv4}.0 netmask 255.255.255.0 {
51 range ${wifiIPv4}.100 ${wifiIPv4}.200;
52 option broadcast-address ${wifiIPv4}.255;
53 option domain-name-servers ${wifiIPv4}.1;
54 option routers ${wifiIPv4}.1;
55 option subnet-mask 255.255.255.0;
56 }
57 '';
58 };
59 # iw dev wlp5s0 station dump
60 # DOC: https://w1.fi/cgit/hostap/plain/hostapd/hostapd.conf
61 services.hostapd = {
62 enable = true;
63 logLevel = 2;
64 interface = wifiIface;
65 # 0 means the AP will search for the channel with the least interferences (ACS)
66 channel = 0;
67 # a=5GHz, g=2.4GHz
68 hwMode = "g";
69 ssid = hostName;
70 wpa = false;
71 inherit wpaPassphrase;
72 countryCode = "FR";
73 extraConfig = ''
74 driver=nl80211
75 # WLAN
76 beacon_int=100
77 dtim_period=2 # DTIM (delivery trafic information message)
78 preamble=1
79 # limit the frequencies used to those allowed in the country
80 ieee80211d=1
81 disassoc_low_ack=1
82 ignore_broadcast_ssid=1
83
84 # WPA2
85 wpa_key_mgmt=WPA-PSK
86 wpa_pairwise=CCMP
87 rsn_pairwise=CCMP
88 auth_algs=1 # 0=noauth, 1=wpa, 2=wep, 3=both
89 macaddr_acl=0
90 # QoS support, also required for full speed on 802.11n/ac/ax
91 wmm_enabled=1
92 eap_reauth_period=360000
93 wpa_group_rekey=600
94 wpa_ptk_rekey=600
95 wpa_gmk_rekey=86400
96
97 # N-WLAN
98 ieee80211n=1
99 # See per band "Capabilities:" section in iw list
100 ht_capab=[HT40+][SHORT-GI-40][MAX-AMSDU-3839][DSSS_CCK-40]
101 require_ht=1
102 obss_interval=0
103
104 # 802.11ac support
105 ieee80211ac=0
106 '';
107 };
108
109 }