]> Git — Sourcephile - sourcephile-nix.git/blob - machines/losurdo/networking/wireless.nix
nix: update patches
[sourcephile-nix.git] / machines / losurdo / networking / wireless.nix
1 { pkgs, lib, config, machines, ... }:
2 let iface = "wlp4s0";
3 in
4 {
5 networking.interfaces.${iface} = {
6 ipv4.addresses = [
7 { address = "192.168.2.1"; prefixLength = 24; }
8 ];
9 };
10 boot.kernel.sysctl."net.ipv6.conf.${iface}.addr_gen_mode" = 1;
11 networking.nftables.ruleset = ''
12 # Hook ${iface} into relevant chains
13 add rule inet filter input iifname "${iface}" jump wifi2fw
14 add rule inet filter input iifname "${iface}" log level warn prefix "wifi2fw: " counter drop
15 add rule inet filter output oifname "${iface}" jump fw2wifi
16 add rule inet filter output oifname "${iface}" log level warn prefix "fw2wifi: " counter drop
17
18 # ${iface} firewalling
19 add rule inet filter fw2wifi counter accept
20 add rule inet filter forward iifname "${iface}" jump fwd-wifi
21
22 # Allow forwarding to the internet
23 add rule inet filter fwd-wifi oifname "enp5s0" counter accept
24
25 # Allow networking services
26 add rule inet filter wifi2fw udp dport 53 counter accept comment "DNS"
27 add rule inet filter wifi2fw tcp dport 53 counter accept comment "DNS"
28 add rule inet filter wifi2fw tcp dport 67 counter accept comment "DHCP"
29 '';
30 #boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
31
32 services.unbound.extraConfig = ''
33 server:
34 interface: 192.168.2.1
35 access-control: 192.168.2.0/24 allow
36 local-zone: "tracking.intl.miui.com" always_refuse
37 local-zone: sourcephile.fr typetransparent
38 local-data: "bureau1.sourcephile.fr A 192.168.2.1"
39 '';
40
41 networking.wlanInterfaces = {
42 ${iface} = {
43 device = "phy0";
44 };
45 };
46
47 /*
48 networking.networkmanager.unmanaged = [
49 "interface-name:phy0"
50 "interface-name:${iface}"
51 ];
52 */
53
54 services.hostapd = {
55 enable = true;
56 logLevel = 2;
57 interface = iface;
58 hwMode = "g";
59 ssid = "bureau1";
60 wpa = true;
61 wpaPassphrase = "bidonpoissonmaisonronron";
62 countryCode = "FR";
63 extraConfig = ''
64 '';
65 };
66 services.dhcpd4 = {
67 enable = true;
68 interfaces = [ iface ];
69 extraConfig = ''
70 option subnet-mask 255.255.255.0;
71 option broadcast-address 192.168.2.255;
72 option routers 192.168.2.1;
73 option domain-name-servers 192.168.2.1;
74 subnet 192.168.2.0 netmask 255.255.255.0 {
75 range 192.168.2.100 192.168.2.200;
76 }
77 '';
78 };
79
80 #networking.firewall.allowedUDPPorts = [ 53 67 ]; # DNS & DHCP
81 /*
82 # Sometimes slow connection speeds are attributed to absence of haveged.
83 services.haveged.enable = true;
84 */
85
86 /*
87
88 systemd.services.wifi-relay = let inherit (pkgs) iptables gnugrep;
89 in {
90 description = "iptables rules for wifi-relay";
91 after = [ "dhcpd4.service" ];
92 wantedBy = [ "multi-user.target" ];
93 script = ''
94 ${iptables}/bin/iptables -w -t nat -I POSTROUTING -s 192.168.2.0/24 ! -o wlp4s0 -j MASQUERADE
95 ${iptables}/bin/iptables -w -I FORWARD -i wlp4s0 -s 192.168.2.0/24 -j ACCEPT
96 ${iptables}/bin/iptables -w -I FORWARD -i wlan-station0 -d 192.168.2.0/24 -j ACCEPT
97 '';
98 };
99 */
100 }