hosts/losurdo/networking/wireless.nix

   1 { pkgs, ... }:
   2 let
   3   wifiIface = "wlp4s0";
   4   gwIface = "enp5s0";
   5   #gwIface = config.networking.defaultGateway.interface;
   6 in
   7 {
   8   environment.systemPackages = [
   9     pkgs.iw
  10   ];
  11   networking.interfaces.${wifiIface} = {
  12     ipv4.addresses = [{ address = "192.168.2.1"; prefixLength = 24; }];
  13   };
  14   # Not merged, even though all are 1
  15   #boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
  16   boot.kernel.sysctl."net.ipv6.conf.${wifiIface}.addr_gen_mode" = 1;
  17   networking.nftables.ruleset = ''
  18     table inet filter {
  19       chain input-lan {
  20         meta l4proto { udp, tcp } th dport domain counter accept comment "DNS"
  21         tcp dport bootps counter accept comment "DHCP"
  22       }
  23       chain input {
  24         iifname ${wifiIface} goto input-lan
  25       }
  26       chain output-lan {
  27         counter accept
  28       }
  29       chain output {
  30         oifname ${wifiIface} goto output-lan
  31       }
  32       chain forward {
  33         iifname ${wifiIface} oifname ${gwIface} counter accept
  34         iifname ${gwIface} oifname ${wifiIface} counter accept
  35       }
  36     }
  37   '';
  38
  39   services.unbound.settings = {
  40     server = {
  41       interface = [ "192.168.2.1" ];
  42       access-control = [ "192.168.2.0/24 allow" ];
  43       local-zone = [
  44         "tracking.intl.miui.com always_refuse"
  45         "sourcephile.fr typetransparent"
  46       ];
  47       local-data = [
  48         "\"bureau1.sourcephile.fr A 192.168.2.1\""
  49       ];
  50     };
  51   };
  52
  53   networking.wlanInterfaces.${wifiIface} = {
  54     device = "phy0";
  55   };
  56
  57   /*
  58     networking.networkmanager.unmanaged = [
  59     "interface-name:phy0"
  60     "interface-name:${wifiIface}"
  61     ];
  62   */
  63
  64   # iw dev wlp4s0 station dump
  65   # DOC: https://w1.fi/cgit/hostap/plain/hostapd/hostapd.conf
  66   services.hostapd = {
  67     enable = true;
  68     logLevel = 2;
  69     interface = wifiIface;
  70     hwMode = "g";
  71     ssid = "bureau1";
  72     wpa = true;
  73     wpaPassphrase = "bidonpoissonmaisonronron";
  74     countryCode = "FR";
  75     extraConfig = ''
  76       # WLAN
  77       beacon_int=100
  78       dtim_period=2 # DTIM (delivery trafic information message)
  79       preamble=1
  80       # limit the frequencies used to those allowed in the country
  81       ieee80211d=1
  82       # 0 means the AP will search for the channel with the least interferences (ACS)
  83       channel=1
  84
  85       # WPA2
  86       wpa_key_mgmt=WPA-PSK
  87       wpa_pairwise=CCMP
  88       rsn_pairwise=CCMP
  89       auth_algs=1 # 0=noauth, 1=wpa, 2=wep, 3=both
  90       macaddr_acl=0
  91       # QoS support, also required for full speed on 802.11n/ac/ax
  92       wmm_enabled=1
  93       eap_reauth_period=360000
  94       wpa_group_rekey=600
  95       wpa_ptk_rekey=600
  96       wpa_gmk_rekey=86400
  97
  98       # N-WLAN
  99       ieee80211n=1
 100       # See Capabilities in iw list
 101       ht_capab=[HT40+][SHORT-GI-40][DSSS_CCK-40][MAX-AMSDU-7935]
 102       require_ht=1
 103       obss_interval=0
 104
 105       # 802.11ac support
 106       ieee80211ac=0
 107     '';
 108   };
 109   systemd.services.dhcpd4 = {
 110     after = [ "network-addresses-${wifiIface}.service" ];
 111     requires = [
 112       "network-addresses-${wifiIface}.service"
 113       "sys-subsystem-net-devices-${wifiIface}.device"
 114     ];
 115   };
 116   services.dhcpd4 = {
 117     enable = true;
 118     interfaces = [ wifiIface ];
 119     extraConfig = ''
 120       option subnet-mask 255.255.255.0;
 121       option broadcast-address 192.168.2.255;
 122       option routers 192.168.2.1;
 123       option domain-name-servers 192.168.2.1;
 124       subnet 192.168.2.0 netmask 255.255.255.0 {
 125         range 192.168.2.100 192.168.2.200;
 126       }
 127     '';
 128   };
 129
 130   #networking.firewall.allowedUDPPorts = [ 53 67 ]; # DNS & DHCP
 131   /*
 132     # Sometimes slow connection speeds are attributed to absence of haveged.
 133     services.haveged.enable = true;
 134   */
 135
 136   /*
 137
 138     systemd.services.wifi-relay = let inherit (pkgs) iptables gnugrep;
 139     in {
 140     description = "iptables rules for wifi-relay";
 141     after = [ "dhcpd4.service" ];
 142     wantedBy = [ "multi-user.target" ];
 143     script = ''
 144     ${iptables}/bin/iptables -w -t nat -I POSTROUTING -s 192.168.2.0/24 ! -o wlan-ap0 -j MASQUERADE
 145     ${iptables}/bin/iptables -w -I FORWARD -i wlan-ap0 -s 192.168.2.0/24 -j ACCEPT
 146     ${iptables}/bin/iptables -w -I FORWARD -i wlan-station0 -d 192.168.2.0/24 -j ACCEPT
 147     '';
 148     };
 149   */
 150 }