From d7e7271306957131ed42f2ede04038d745468fd3 Mon Sep 17 00:00:00 2001 From: Kjetil Orbekk Date: Sun, 26 Feb 2023 17:19:56 -0500 Subject: router config --- modules/router.nix | 46 +++++++++++++++++++++++++++++++++++++++++----- tools/update-dns.sh | 4 ++-- 2 files changed, 43 insertions(+), 7 deletions(-) diff --git a/modules/router.nix b/modules/router.nix index d49d433..95d5d75 100644 --- a/modules/router.nix +++ b/modules/router.nix @@ -7,6 +7,9 @@ let mullvadMark = 2; heMark = 1; + mullvadPort = config.orbekk.mullvad.listenPort; + vpnPort = config.orbekk.vpn.listenPort; + router-netns-up = pkgs.writeScript "router-netns-up" '' #!${pkgs.bash}/bin/bash ip netns add router @@ -33,10 +36,11 @@ let environment.systemPackages = with pkgs; [ tcpdump ]; virtualisation.vswitch.enable = true; - virtualisation.vswitch.resetOnStart = true; + virtualisation.vswitch.resetOnStart = false; networking.vswitches.kjlan = { interfaces.wan-vport = { vlan = 10; type = "internal"; }; interfaces.lan-vport = { vlan = 100; type = "internal"; }; + interfaces.vpnlan-vport = { vlan = 30; type = "internal"; }; interfaces.servers-vport = { vlan = 20; type = "internal"; }; interfaces.admin-vport = { vlan = 255; type = "internal"; }; interfaces.dragon-vport = { vlan = 20; }; @@ -54,6 +58,7 @@ let }; networking.interfaces.lan-vport = { ipv4.addresses = [{address = "172.20.100.1"; prefixLength = 24;}]; + ipv6.addresses = [{address = "2001:470:8e2e:100::1"; prefixLength = 64;}]; }; networking.interfaces.servers-vport = { ipv4.addresses = [{address = "172.20.20.1"; prefixLength = 24;}]; @@ -114,7 +119,7 @@ let dhcp-range=tag:servers-vport,172.20.20.10,172.20.20.254,5m dhcp-option=tag:servers-vport,option:router,172.20.20.1 dhcp-option=tag:servers-vport,option:dns-server,172.20.20.1 - dhcp-range=tag:servers-vport,::2,::1000,constructor:servers-vport,2h + dhcp-range=tag:servers-vport,::2,::1000,constructor:servers-vport dhcp-host=id:dragon,tag:servers-vport,172.20.20.2 dhcp-host=id:00:01:00:01:21:a2:4e:a8:d0:bf:9c:45:a6:ec,tag:servers-vport,[::d] # dhcp-host=id:dragon,::d @@ -122,6 +127,7 @@ let dhcp-range=tag:lan-vport,172.20.100.10,172.20.100.254,5m dhcp-option=tag:lan-vport,option:router,172.20.100.1 dhcp-option=tag:lan-vport,option:dns-server,172.20.100.1 + dhcp-range=tag:lan-vport,::2,::1000,constructor:lan-vport,ra-only ''; }; @@ -139,12 +145,19 @@ let networking.firewall.enable = false; systemd.services.nftables.before = mkForce ["network.target"]; systemd.services.nftables.after = ["kjlan-netdev.service"]; - systemd.services.nftables.wantedBy = ["network.target"]; + systemd.services.nftables.wantedBy = mkForce ["network.target"]; networking.nftables.enable = true; networking.nftables.ruleset = let ports-to-csv = ports: concatStringsSep "," (map toString ports); in '' + define SERVER_WAN_PORTS = { + ssh, domain, http, https, + ${toString mullvadPort}, ${toString vpnPort} + } + define SERVER_LAN_PORTS = { + tftp, 139, 445, 137, 138 + } table inet filter { chain input { type filter hook input priority 0 @@ -171,9 +184,15 @@ let chain forward { type filter hook forward priority 0; policy drop + ip protocol icmp limit rate 4/second counter accept comment "icmp v4" + ip6 nexthdr ipv6-icmp limit rate 4/second counter accept comment "accept all ICMP types" + ct state vmap { established : accept, related : accept, invalid : drop } + oif he0 counter accept + oif wan-vport counter accept - iif lan-vport counter accept + oif servers-vport meta l4proto {tcp, udp} th dport $SERVER_WAN_PORTS counter accept + iif lan-vport oif servers-vport meta l4proto {tcp, udp} th dport $SERVER_LAN_PORTS counter accept iif servers-vport counter accept counter drop @@ -183,7 +202,7 @@ let table inet mangle { chain prerouting { type filter hook prerouting priority -150 - ip6 saddr 2001:470:8e2e::/48 ip6 daddr != 2001:470:8e2e::/48 ip6 daddr != fe80::/64 meta nftrace set 1 + # ip6 saddr 2001:470:8e2e::/48 ip6 daddr != 2001:470:8e2e::/48 ip6 daddr != fe80::/64 meta nftrace set 1 ip6 saddr 2001:470:8e2e::/48 ip6 daddr != 2001:470:8e2e::/48 ip6 daddr != fe80::/64 meta mark set ${toString heMark} } } @@ -235,6 +254,7 @@ in { requires = ["router-netns.service"]; wantedBy = ["network.target"]; }; + systemd.services.dhcpcd.partOf = ["container@router.service"]; containers.router = { autoStart = true; @@ -250,5 +270,21 @@ in { }; # FIXME: Workaround for ddclient.conf not being available to ddclient. systemd.services.ddclient.serviceConfig.DynamicUser = lib.mkForce false; + + systemd.timers.update-dynamic-dns = { + wantedBy = ["multi-user.target"]; + timerConfig = { + Persistent = true; + OnBootSec = "5m"; + OnUnitActiveSec = "5m"; + }; + }; + systemd.services.update-dynamic-dns = { + description = "Update dynamic dns records"; + after = ["container@router.target"]; + path = with pkgs; [ bash dnsutils nettools gawk iproute curl ]; + startLimitIntervalSec = 5; + script = toString ../tools/update-dns.sh; + }; }; } diff --git a/tools/update-dns.sh b/tools/update-dns.sh index a08ac26..f4f08e6 100755 --- a/tools/update-dns.sh +++ b/tools/update-dns.sh @@ -1,5 +1,5 @@ keyfile=/opt/secret/bind/dynamic.orbekk.com/update/named.conf.key -INTERFACE=bond0.10 +INTERFACE=wan-vport update() { local type="$1" @@ -18,7 +18,7 @@ update() { } | nsupdate -v -k "$keyfile" } -ip_4="$(ip -br -4 addr list dev ${INTERFACE} | awk -F' *|/' '{print $3}')" +ip_4="$(ip netns exec router ip -br -4 addr list dev ${INTERFACE} | awk -F' *|/' '{print $3}')" if [[ -n "$ip_4" ]]; then update A $(hostname).dynamic.orbekk.com $ip_4 fi -- cgit v1.2.3