machines/losurdo/networking/wireless.nix

   1 { pkgs, lib, config, machines, ... }:
   2 let iface = "wlp4s0";
   3 in
   4 {
   5 networking.interfaces.${iface} = {
   6   ipv4.addresses = [
   7     { address = "192.168.2.1"; prefixLength = 24; }
   8   ];
   9 };
  10 boot.kernel.sysctl."net.ipv6.conf.${iface}.addr_gen_mode" = 1;
  11 networking.nftables.ruleset = ''
  12   # Hook ${iface} into relevant chains
  13   add rule inet filter input  iifname "${iface}" jump wifi2fw
  14   add rule inet filter input  iifname "${iface}" log level warn prefix "wifi2fw: " counter drop
  15   add rule inet filter output oifname "${iface}" jump fw2wifi
  16   add rule inet filter output oifname "${iface}" log level warn prefix "fw2wifi: " counter drop
  17
  18   # ${iface} firewalling
  19   add rule inet filter fw2wifi counter accept
  20   add rule inet filter forward iifname "${iface}" jump fwd-wifi
  21
  22   # Allow forwarding to the internet
  23   add rule inet filter fwd-wifi oifname "enp5s0" counter accept
  24
  25   # Allow networking services
  26   add rule inet filter wifi2fw udp dport 53 counter accept comment "DNS"
  27   add rule inet filter wifi2fw tcp dport 53 counter accept comment "DNS"
  28   add rule inet filter wifi2fw tcp dport 67 counter accept comment "DHCP"
  29 '';
  30 #boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
  31
  32 services.unbound.extraConfig = ''
  33   server:
  34     interface: 192.168.2.1
  35     access-control: 192.168.2.0/24 allow
  36     local-zone: "tracking.intl.miui.com" always_refuse
  37     local-zone: sourcephile.fr typetransparent
  38     local-data: "bureau1.sourcephile.fr A 192.168.2.1"
  39 '';
  40
  41 networking.wlanInterfaces = {
  42   ${iface} = {
  43     device = "phy0";
  44   };
  45 };
  46
  47 /*
  48 networking.networkmanager.unmanaged = [
  49   "interface-name:phy0"
  50   "interface-name:${iface}"
  51 ];
  52 */
  53
  54 services.hostapd = {
  55   enable = true;
  56   logLevel = 2;
  57   interface = iface;
  58   hwMode = "g";
  59   ssid = "bureau1";
  60   wpa = true;
  61   wpaPassphrase = "bidonpoissonmaisonronron";
  62   countryCode = "FR";
  63   extraConfig = ''
  64   '';
  65 };
  66 services.dhcpd4 = {
  67   enable = true;
  68   interfaces = [ iface ];
  69   extraConfig = ''
  70     option subnet-mask 255.255.255.0;
  71     option broadcast-address 192.168.2.255;
  72     option routers 192.168.2.1;
  73     option domain-name-servers 192.168.2.1;
  74     subnet 192.168.2.0 netmask 255.255.255.0 {
  75       range 192.168.2.100 192.168.2.200;
  76     }
  77   '';
  78 };
  79
  80 #networking.firewall.allowedUDPPorts = [ 53 67 ]; # DNS & DHCP
  81 /*
  82 # Sometimes slow connection speeds are attributed to absence of haveged.
  83 services.haveged.enable = true;
  84 */
  85
  86 /*
  87
  88 systemd.services.wifi-relay = let inherit (pkgs) iptables gnugrep;
  89 in {
  90   description = "iptables rules for wifi-relay";
  91   after = [ "dhcpd4.service" ];
  92   wantedBy = [ "multi-user.target" ];
  93   script = ''
  94     ${iptables}/bin/iptables -w -t nat -I POSTROUTING -s 192.168.2.0/24 ! -o wlp4s0 -j MASQUERADE
  95     ${iptables}/bin/iptables -w -I FORWARD -i wlp4s0 -s 192.168.2.0/24 -j ACCEPT
  96     ${iptables}/bin/iptables -w -I FORWARD -i wlan-station0 -d 192.168.2.0/24 -j ACCEPT
  97   '';
  98 };
  99 */
 100 }