{ pkgs, lib, config, hosts, ... }: let iface = "wlp5s0"; gateway = "enp2s0"; #gateway = config.networking.defaultGateway.interface; in { environment.systemPackages = [ pkgs.iw ]; networking.interfaces.${iface} = { ipv4.addresses = [ { address = "192.168.6.1"; prefixLength = 24; } ]; }; # Not merged, even though all are 1 #boot.kernel.sysctl."net.ipv4.ip_forward" = 1; boot.kernel.sysctl."net.ipv6.conf.${iface}.addr_gen_mode" = 1; networking.nftables.ruleset = '' table inet filter { chain input-wifi { meta l4proto { udp, tcp } th dport domain counter accept comment "DNS" tcp dport bootps counter accept comment "DHCP" } chain input { iifname ${iface} jump input-wifi iifname ${iface} log level warn prefix "input-wifi: " counter drop } chain output-wifi { counter accept } chain output { oifname ${iface} jump output-wifi oifname ${iface} log level warn prefix "output-wifi: " counter drop } chain forward { iifname ${iface} oifname ${gateway} counter accept iifname ${gateway} oifname ${iface} counter accept } } ''; services.unbound.settings = { server = { interface = [ "192.168.6.1" ]; access-control = ["192.168.6.0/24 allow"]; local-zone = [ "tracking.intl.miui.com always_refuse" "sourcephile.fr typetransparent" ]; local-data = [ "\"bureau1.sourcephile.fr A 192.168.6.1\"" ]; }; }; networking.wlanInterfaces.${iface} = { device = "phy0"; }; /* networking.networkmanager.unmanaged = [ "interface-name:phy0" "interface-name:${iface}" ]; */ # iw dev wlp4s0 station dump # DOC: https://w1.fi/cgit/hostap/plain/hostapd/hostapd.conf services.hostapd = { enable = true; logLevel = 2; interface = iface; hwMode = "g"; ssid = "bureau1"; wpa = true; wpaPassphrase = "bidonpoissonmaisonronron"; countryCode = "FR"; extraConfig = '' # WLAN beacon_int=100 dtim_period=2 # DTIM (delivery trafic information message) preamble=1 # limit the frequencies used to those allowed in the country ieee80211d=1 # 0 means the AP will search for the channel with the least interferences (ACS) channel=1 # WPA2 wpa_key_mgmt=WPA-PSK wpa_pairwise=CCMP rsn_pairwise=CCMP auth_algs=1 # 0=noauth, 1=wpa, 2=wep, 3=both macaddr_acl=0 # QoS support, also required for full speed on 802.11n/ac/ax wmm_enabled=1 eap_reauth_period=360000 wpa_group_rekey=600 wpa_ptk_rekey=600 wpa_gmk_rekey=86400 # N-WLAN ieee80211n=1 # See Capabilities in iw list ht_capab=[HT40+][SHORT-GI-40][DSSS_CCK-40][MAX-AMSDU-7935] require_ht=1 obss_interval=0 # 802.11ac support ieee80211ac=0 ''; }; systemd.services."dhcpd4" = { after = [ "network-addresses-${iface}.service" ]; requires = [ "network-addresses-${iface}.service" "sys-subsystem-net-devices-${iface}.device" ]; }; services.dhcpd4 = { enable = true; interfaces = [ iface ]; extraConfig = '' option subnet-mask 255.255.255.0; option broadcast-address 192.168.6.255; option routers 192.168.6.1; option domain-name-servers 192.168.6.1; subnet 192.168.6.0 netmask 255.255.255.0 { range 192.168.6.100 192.168.6.200; } ''; }; #networking.firewall.allowedUDPPorts = [ 53 67 ]; # DNS & DHCP /* # Sometimes slow connection speeds are attributed to absence of haveged. services.haveged.enable = true; */ /* systemd.services.wifi-relay = let inherit (pkgs) iptables gnugrep; in { description = "iptables rules for wifi-relay"; after = [ "dhcpd4.service" ]; wantedBy = [ "multi-user.target" ]; script = '' ${iptables}/bin/iptables -w -t nat -I POSTROUTING -s 192.168.6.0/24 ! -o wlan-ap0 -j MASQUERADE ${iptables}/bin/iptables -w -I FORWARD -i wlan-ap0 -s 192.168.6.0/24 -j ACCEPT ${iptables}/bin/iptables -w -I FORWARD -i wlan-station0 -d 192.168.6.0/24 -j ACCEPT ''; }; */ }