hosts/losurdo/networking/wireless.nix

   1 { pkgs, lib, config, hosts, ... }:
   2 let
   3   wifiIface = "wlp4s0";
   4   gwIface = "enp5s0";
   5   #gwIface = config.networking.defaultGateway.interface;
   6 in
   7 {
   8 environment.systemPackages = [
   9   pkgs.iw
  10 ];
  11 networking.interfaces.${wifiIface} = {
  12   ipv4.addresses = [ { address = "192.168.2.1"; prefixLength = 24; } ];
  13 };
  14 # Not merged, even though all are 1
  15 #boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
  16 boot.kernel.sysctl."net.ipv6.conf.${wifiIface}.addr_gen_mode" = 1;
  17 networking.nftables.ruleset = ''
  18   table inet filter {
  19     chain input-lan {
  20       meta l4proto { udp, tcp } th dport domain counter accept comment "DNS"
  21       tcp dport bootps counter accept comment "DHCP"
  22     }
  23     chain input {
  24       iifname ${wifiIface} goto input-lan
  25     }
  26     chain output-lan {
  27       counter accept
  28     }
  29     chain output {
  30       oifname ${wifiIface} goto output-lan
  31     }
  32     chain forward {
  33       iifname ${wifiIface} oifname ${gwIface} counter accept
  34       iifname ${gwIface} oifname ${wifiIface} counter accept
  35     }
  36   }
  37 '';
  38
  39 services.unbound.settings = {
  40   server = {
  41     interface = [ "192.168.2.1" ];
  42     access-control = ["192.168.2.0/24 allow"];
  43     local-zone = [
  44       "tracking.intl.miui.com always_refuse"
  45       "sourcephile.fr typetransparent"
  46     ];
  47     local-data = [
  48       "\"bureau1.sourcephile.fr A 192.168.2.1\""
  49     ];
  50   };
  51 };
  52
  53 networking.wlanInterfaces.${wifiIface} = {
  54   device = "phy0";
  55 };
  56
  57 /*
  58 networking.networkmanager.unmanaged = [
  59   "interface-name:phy0"
  60   "interface-name:${wifiIface}"
  61 ];
  62 */
  63
  64 # iw dev wlp4s0 station dump
  65 # DOC: https://w1.fi/cgit/hostap/plain/hostapd/hostapd.conf
  66 services.hostapd = {
  67   enable = true;
  68   logLevel = 2;
  69   interface = wifiIface;
  70   hwMode = "g";
  71   ssid = "bureau1";
  72   wpa = true;
  73   wpaPassphrase = "bidonpoissonmaisonronron";
  74   countryCode = "FR";
  75   extraConfig = ''
  76     # WLAN
  77     beacon_int=100
  78     dtim_period=2 # DTIM (delivery trafic information message)
  79     preamble=1
  80     # limit the frequencies used to those allowed in the country
  81     ieee80211d=1
  82     # 0 means the AP will search for the channel with the least interferences (ACS)
  83     channel=1
  84
  85     # WPA2
  86     wpa_key_mgmt=WPA-PSK
  87     wpa_pairwise=CCMP
  88     rsn_pairwise=CCMP
  89     auth_algs=1 # 0=noauth, 1=wpa, 2=wep, 3=both
  90     macaddr_acl=0
  91     # QoS support, also required for full speed on 802.11n/ac/ax
  92     wmm_enabled=1
  93     eap_reauth_period=360000
  94     wpa_group_rekey=600
  95     wpa_ptk_rekey=600
  96     wpa_gmk_rekey=86400
  97
  98     # N-WLAN
  99     ieee80211n=1
 100     # See Capabilities in iw list
 101     ht_capab=[HT40+][SHORT-GI-40][DSSS_CCK-40][MAX-AMSDU-7935]
 102     require_ht=1
 103     obss_interval=0
 104
 105     # 802.11ac support
 106     ieee80211ac=0
 107   '';
 108 };
 109 systemd.services.dhcpd4 = {
 110   after = [ "network-addresses-${wifiIface}.service" ];
 111   requires = [
 112     "network-addresses-${wifiIface}.service"
 113     "sys-subsystem-net-devices-${wifiIface}.device"
 114   ];
 115 };
 116 services.dhcpd4 = {
 117   enable = true;
 118   interfaces = [ wifiIface ];
 119   extraConfig = ''
 120     option subnet-mask 255.255.255.0;
 121     option broadcast-address 192.168.2.255;
 122     option routers 192.168.2.1;
 123     option domain-name-servers 192.168.2.1;
 124     subnet 192.168.2.0 netmask 255.255.255.0 {
 125       range 192.168.2.100 192.168.2.200;
 126     }
 127   '';
 128 };
 129
 130 #networking.firewall.allowedUDPPorts = [ 53 67 ]; # DNS & DHCP
 131 /*
 132 # Sometimes slow connection speeds are attributed to absence of haveged.
 133 services.haveged.enable = true;
 134 */
 135
 136 /*
 137
 138 systemd.services.wifi-relay = let inherit (pkgs) iptables gnugrep;
 139 in {
 140   description = "iptables rules for wifi-relay";
 141   after = [ "dhcpd4.service" ];
 142   wantedBy = [ "multi-user.target" ];
 143   script = ''
 144     ${iptables}/bin/iptables -w -t nat -I POSTROUTING -s 192.168.2.0/24 ! -o wlan-ap0 -j MASQUERADE
 145     ${iptables}/bin/iptables -w -I FORWARD -i wlan-ap0 -s 192.168.2.0/24 -j ACCEPT
 146     ${iptables}/bin/iptables -w -I FORWARD -i wlan-station0 -d 192.168.2.0/24 -j ACCEPT
 147   '';
 148 };
 149 */
 150 }