{ lib, ... }: with (import ./names-and-numbers.nix); { services.dnscrypt-proxy2.settings.listen_addresses = [ "${eth1IPv4}.1:53" "${eth2IPv4}.1:53" "${eth3IPv4}.1:53" ]; networking.interfaces = { ${eth1Iface} = { useDHCP = false; ipv4.addresses = [{ address = "${eth1IPv4}.1"; prefixLength = 24; }]; }; ${eth2Iface} = { useDHCP = false; ipv4.addresses = [{ address = "${eth2IPv4}.1"; prefixLength = 24; }]; }; ${eth3Iface} = { useDHCP = false; ipv4.addresses = [{ address = "${eth3IPv4}.1"; prefixLength = 24; }]; }; }; networking.networkmanager = { #enable = true; unmanaged = [ eth1Iface eth2Iface eth3Iface ]; }; networking.nftables.ruleset = lib.mkAfter '' table inet filter { chain input { iifname { ${eth1Iface}, ${eth2Iface}, ${eth3Iface} } jump input-lan iifname { ${eth1Iface}, ${eth2Iface}, ${eth3Iface} } log level warn prefix "input-lan: " counter drop } chain output { oifname { ${eth1Iface}, ${eth2Iface}, ${eth3Iface} } jump output-lan oifname { ${eth1Iface}, ${eth2Iface}, ${eth3Iface} } log level warn prefix "output-lan: " counter drop } } ''; systemd.services.dhcpd4.onFailure = [ "network-addresses-${eth1Iface}.service" "network-addresses-${eth2Iface}.service" "network-addresses-${eth3Iface}.service" ]; services.dhcpd4 = { enable = true; interfaces = [ eth1Iface eth2Iface eth3Iface ]; extraConfig = '' subnet ${eth1IPv4}.0 netmask 255.255.255.0 { range ${eth1IPv4}.100 ${eth1IPv4}.200; option broadcast-address ${eth1IPv4}.255; option domain-name-servers ${eth1IPv4}.1; option routers ${eth1IPv4}.1; option subnet-mask 255.255.255.0; } subnet ${eth2IPv4}.0 netmask 255.255.255.0 { range ${eth2IPv4}.100 ${eth2IPv4}.200; option broadcast-address ${eth2IPv4}.255; option domain-name-servers ${eth2IPv4}.1; option routers ${eth2IPv4}.1; option subnet-mask 255.255.255.0; } subnet ${eth3IPv4}.0 netmask 255.255.255.0 { range ${eth3IPv4}.100 ${eth3IPv4}.200; option broadcast-address ${eth3IPv4}.255; option domain-name-servers ${eth3IPv4}.1; option routers ${eth3IPv4}.1; option subnet-mask 255.255.255.0; } ''; }; services.openssh.listenAddresses = [ { addr = "${eth1IPv4}.1"; port = 22; } { addr = "${eth2IPv4}.1"; port = 22; } { addr = "${eth3IPv4}.1"; port = 22; } ]; }