hosts/losurdo/networking/wireless.nix

   1 { pkgs, lib, config, hosts, ... }:
   2 let iface = "wlp4s0";
   3 in
   4 {
   5 environment.systemPackages = [
   6   pkgs.iw
   7 ];
   8 networking.interfaces.${iface} = {
   9   ipv4.addresses = [ { address = "192.168.2.1"; prefixLength = 24; } ];
  10 };
  11 # Fix to set the address before starting dhcpd4.service
  12 systemd.services."network-addresses-${iface}" = {
  13   before = ["network.target"];
  14   wantedBy = ["network.target"];
  15 };
  16 boot.kernel.sysctl."net.ipv6.conf.${iface}.addr_gen_mode" = 1;
  17 networking.nftables.ruleset = ''
  18   # Hook ${iface} into relevant chains
  19   add rule inet filter input  iifname "${iface}" jump wifi2fw
  20   add rule inet filter input  iifname "${iface}" log level warn prefix "wifi2fw: " counter drop
  21   add rule inet filter output oifname "${iface}" jump fw2wifi
  22   add rule inet filter output oifname "${iface}" log level warn prefix "fw2wifi: " counter drop
  23
  24   # ${iface} firewalling
  25   add rule inet filter fw2wifi counter accept
  26   add rule inet filter forward iifname "${iface}" jump fwd-wifi
  27
  28   # Allow forwarding to the internet
  29   add rule inet filter fwd-wifi oifname "enp5s0" counter accept
  30
  31   # Allow networking services
  32   add rule inet filter wifi2fw udp dport 53 counter accept comment "DNS"
  33   add rule inet filter wifi2fw tcp dport 53 counter accept comment "DNS"
  34   add rule inet filter wifi2fw tcp dport 67 counter accept comment "DHCP"
  35 '';
  36 #boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
  37
  38 services.unbound.settings = {
  39   server = {
  40     interface = [ "192.168.2.1" ];
  41     access-control = ["192.168.2.0/24 allow"];
  42     local-zone = [
  43       "tracking.intl.miui.com always_refuse"
  44       "sourcephile.fr typetransparent"
  45     ];
  46     local-data = [
  47       "\"bureau1.sourcephile.fr A 192.168.2.1\""
  48     ];
  49   };
  50 };
  51
  52 networking.wlanInterfaces.${iface} = {
  53   device = "phy0";
  54 };
  55
  56 /*
  57 networking.networkmanager.unmanaged = [
  58   "interface-name:phy0"
  59   "interface-name:${iface}"
  60 ];
  61 */
  62
  63 # iw dev wlp4s0 station dump
  64 services.hostapd = {
  65   enable = true;
  66   logLevel = 2;
  67   interface = iface;
  68   # a = IEEE 802.11a, b = IEEE 802.11b, g = IEEE 802.11g
  69   hwMode = "g";
  70   ssid = "bureau1";
  71   wpa = true;
  72   wpaPassphrase = "bidonpoissonmaisonronron";
  73   countryCode = "FR";
  74   extraConfig = ''
  75     # WLAN
  76     beacon_int=100
  77     dtim_period=2 # DTIM (delivery trafic information message)
  78     max_num_sta=255 # Maximum number of stations allowed in station table
  79     rts_threshold=2347 # RTS/CTS threshold; 2347 = disabled (default)
  80     fragm_threshold=2346 # Fragmentation threshold; 2346 = disabled (default)
  81     preamble=1
  82
  83     # WPA2
  84     wpa_key_mgmt=WPA-PSK
  85     wpa_pairwise=CCMP
  86     rsn_pairwise=CCMP
  87     auth_algs=1 # 0=noauth, 1=wpa, 2=wep, 3=both
  88     macaddr_acl=0
  89     wmm_enabled=1
  90     eap_reauth_period=360000
  91     wpa_group_rekey=600
  92     wpa_ptk_rekey=600
  93     wpa_gmk_rekey=86400
  94
  95     # N-WLAN
  96     ieee80211n=1
  97     # See Capabilities in iw list
  98     ht_capab=[HT40+][SHORT-GI-40][DSSS_CCK-40][MAX-AMSDU-7935]
  99     require_ht=1
 100     obss_interval=0
 101   '';
 102 };
 103 services.dhcpd4 = {
 104   enable = true;
 105   interfaces = [ iface ];
 106   extraConfig = ''
 107     option subnet-mask 255.255.255.0;
 108     option broadcast-address 192.168.2.255;
 109     option routers 192.168.2.1;
 110     option domain-name-servers 192.168.2.1;
 111     subnet 192.168.2.0 netmask 255.255.255.0 {
 112       range 192.168.2.100 192.168.2.200;
 113     }
 114   '';
 115 };
 116
 117 #networking.firewall.allowedUDPPorts = [ 53 67 ]; # DNS & DHCP
 118 /*
 119 # Sometimes slow connection speeds are attributed to absence of haveged.
 120 services.haveged.enable = true;
 121 */
 122
 123 /*
 124
 125 systemd.services.wifi-relay = let inherit (pkgs) iptables gnugrep;
 126 in {
 127   description = "iptables rules for wifi-relay";
 128   after = [ "dhcpd4.service" ];
 129   wantedBy = [ "multi-user.target" ];
 130   script = ''
 131     ${iptables}/bin/iptables -w -t nat -I POSTROUTING -s 192.168.2.0/24 ! -o wlan-ap0 -j MASQUERADE
 132     ${iptables}/bin/iptables -w -I FORWARD -i wlan-ap0 -s 192.168.2.0/24 -j ACCEPT
 133     ${iptables}/bin/iptables -w -I FORWARD -i wlan-station0 -d 192.168.2.0/24 -j ACCEPT
 134   '';
 135 };
 136 */
 137 }