5 #gwIface = config.networking.defaultGateway.interface;
8 environment.systemPackages = [
11 networking.interfaces.${wifiIface} = {
12 ipv4.addresses = [{ address = "192.168.2.1"; prefixLength = 24; }];
14 # Not merged, even though all are 1
15 #boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
16 boot.kernel.sysctl."net.ipv6.conf.${wifiIface}.addr_gen_mode" = 1;
17 networking.nftables.ruleset = ''
20 meta l4proto { udp, tcp } th dport domain counter accept comment "DNS"
21 tcp dport bootps counter accept comment "DHCP"
24 iifname ${wifiIface} goto input-lan
30 oifname ${wifiIface} goto output-lan
33 iifname ${wifiIface} oifname ${gwIface} counter accept
34 iifname ${gwIface} oifname ${wifiIface} counter accept
39 services.unbound.settings = {
41 interface = [ "192.168.2.1" ];
42 access-control = [ "192.168.2.0/24 allow" ];
44 "tracking.intl.miui.com always_refuse"
45 "sourcephile.fr typetransparent"
48 "\"bureau1.sourcephile.fr A 192.168.2.1\""
53 networking.wlanInterfaces.${wifiIface} = {
57 networking.networkmanager.unmanaged = [
61 # iw dev wlp4s0 station dump
62 # DOC: https://w1.fi/cgit/hostap/plain/hostapd/hostapd.conf
65 interface = wifiIface;
72 networks.${wifiIface} = {
77 # FIXME: use wpaPasswordFile or saePasswordsFile
78 wpaPassword = "bidonpoissonmaisonronron";
89 dtim_period=2 # DTIM (delivery trafic information message)
91 # limit the frequencies used to those allowed in the country
93 # 0 means the AP will search for the channel with the least interferences (ACS)
100 auth_algs=1 # 0=noauth, 1=wpa, 2=wep, 3=both
102 # QoS support, also required for full speed on 802.11n/ac/ax
104 eap_reauth_period=360000
111 # See Capabilities in iw list
112 ht_capab=[HT40+][SHORT-GI-40][DSSS_CCK-40][MAX-AMSDU-7935]
121 systemd.services.dhcpd4 = {
122 after = [ "network-addresses-${wifiIface}.service" ];
124 "network-addresses-${wifiIface}.service"
125 "sys-subsystem-net-devices-${wifiIface}.device"
127 unitConfig.StartLimitIntervalSec = 0;
128 serviceConfig.RestartSec = 5;
132 interfaces = [ wifiIface ];
134 option subnet-mask 255.255.255.0;
135 option broadcast-address 192.168.2.255;
136 option routers 192.168.2.1;
137 option domain-name-servers 192.168.2.1;
138 subnet 192.168.2.0 netmask 255.255.255.0 {
139 range 192.168.2.100 192.168.2.200;
145 #networking.firewall.allowedUDPPorts = [ 53 67 ]; # DNS & DHCP
147 # Sometimes slow connection speeds are attributed to absence of haveged.
148 services.haveged.enable = true;
153 systemd.services.wifi-relay = let inherit (pkgs) iptables gnugrep;
155 description = "iptables rules for wifi-relay";
156 after = [ "dhcpd4.service" ];
157 wantedBy = [ "multi-user.target" ];
159 ${iptables}/bin/iptables -w -t nat -I POSTROUTING -s 192.168.2.0/24 ! -o wlan-ap0 -j MASQUERADE
160 ${iptables}/bin/iptables -w -I FORWARD -i wlan-ap0 -s 192.168.2.0/24 -j ACCEPT
161 ${iptables}/bin/iptables -w -I FORWARD -i wlan-station0 -d 192.168.2.0/24 -j ACCEPT