{ config, lib, pkgs, ... }: let wan-dev = "eno1"; lan-dev = "eno2"; mullvadPort = config.orbekk.mullvad.listenPort; mullvadMark = 30; in { orbekk.mullvad.enable = true; networking.networkmanager.enable = lib.mkForce false; networking.nameservers = [ "8.8.8.8" ]; networking.vlans = builtins.listToAttrs (map (id: { name = "${lan-dev}.${toString id}"; value = { inherit id; interface = lan-dev; }; } ) [30 100 255]); systemd.services.update-dynamic-dns = { description = "Update dynamic dns records"; path = with pkgs; [bash dnsutils nettools gawk iproute]; startLimitIntervalSec = 5; script = toString ../tools/update-dns.sh; }; networking.dhcpcd.runHook = '' systemctl restart update-dynamic-dns.service ''; networking.firewall = { enable = lib.mkForce false; allowedTCPPorts = lib.mkForce [ ]; allowedUDPPorts = lib.mkForce [ ]; allowPing = true; logRefusedConnections = false; checkReversePath = false; }; services.ddclient = { enable = true; configFile = "/opt/secret/he-ddclient.conf"; }; services.ferm = { enable = true; config = '' @def $DEV_UNTRUSTED_LAN = (${lan-dev}.30); @def $DEV_LAN = (${lan-dev}.100 ${lan-dev}.255); @def $DEV_WAN = (${wan-dev} he0 mullvad); @def $NET_LAN = 10.0.0.0/8; domain (ip ip6) table filter { chain INPUT { policy DROP; mod state state INVALID DROP; mod state state (ESTABLISHED RELATED) ACCEPT; interface lo ACCEPT; proto icmp ACCEPT; proto (udp udp) dport dhcpv6-client ACCEPT; proto 41 ACCEPT; # IPv6 sit tunnel interface ($DEV_WAN $DEV_UNTRUSTED_LAN) @subchain "wan_services" { proto (tcp udp) dport (bootpc bootps) ACCEPT; proto tcp dport ssh ACCEPT; proto (tcp udp) dport domain ACCEPT; proto tcp dport (http https) ACCEPT; proto udp dport ${toString mullvadPort} ACCEPT; } interface $DEV_LAN @subchain "lan_services" { proto (tcp udp) dport (ssh domain bootpc bootps) ACCEPT; proto tcp dport (http https) ACCEPT; # prometheus temp rule proto tcp dport 11112 ACCEPT; # RTMP streaming proto (tcp udp) dport 1935 ACCEPT; # Chromecast # proto udp dport 32768:61000 ACCEPT; # proto udp dport (5353 1900) ACCEPT; # proto tcp dport (8008 8009) ACCEPT; # chain logdrop { # LOG log-level warning log-prefix "dropped-lan "; # DROP; # } # jump logdrop; } } chain OUTPUT policy ACCEPT; chain FORWARD { policy DROP; mod state state INVALID DROP; mod state state (ESTABLISHED RELATED) ACCEPT; interface $DEV_UNTRUSTED_LAN outerface mullvad ACCEPT; interface $DEV_LAN ACCEPT; } } domain ip6 table filter chain INPUT { proto ipv6-icmp ACCEPT; } domain (ip ip6) table filter chain logdrop { LOG log-level warning log-prefix "dropped "; DROP; } domain (ip ip6) table filter chain INPUT { interface $DEV_WAN DROP; jump logdrop; } domain ip table nat { chain POSTROUTING { saddr $NET_LAN outerface $DEV_WAN MASQUERADE; } } domain (ip ip6) table mangle { chain PREROUTING { interface ${lan-dev}.30 MARK set-mark ${toString mullvadMark}; } } ''; }; services = { openssh.enable = lib.mkDefault true; openssh.passwordAuthentication = false; }; boot.kernel.sysctl = { "net.ipv4.conf.all.forwarding" = true; "net.ipv4.conf.default.forwarding" = true; "net.ipv6.conf.all.forwarding" = true; "net.ipv6.conf.default.forwarding" = true; }; #services.hostapd = { # enable = true; # # driver = "iwlwifi"; # ssid = "2c"; # wpaPassphrase = "mintchip"; # interface = "${lan-dev}"; # hwMode = "g"; # channel = 11; # extraConfig = '' # country_code=US # wpa_key_mgmt=WPA-PSK # rsn_pairwise=CCMP # ''; #}; networking.dhcpcd = { # Wain for v4 and v6 addresses. # wait = "both"; extraConfig = '' debug noipv6rs interface ${wan-dev} dhcp ipv6rs ia_na 0 # ia_pd 1/::/64 ${lan-dev}.100/0/64 ''; }; systemd.services.dhcpcd.preStart = lib.mkAfter '' ${pkgs.iproute}/bin/ip link set dev ${wan-dev} address ${config.networking.interfaces.${wan-dev}.macAddress}; ''; services.dnsmasq = { enable = true; servers = [ "1.1.1.1" "8.8.8.8" "8.8.4.4" ]; extraConfig = '' port=0 dhcp-authoritative dhcp-range=10.65.30.100,10.65.30.255,255.255.255.0,24h dhcp-range=10.64.31.1,10.64.31.255,255.255.254.0,24h dhcp-option=option:router,10.65.30.1 dhcp-option=option:dns-server,1.1.1.1,8.8.8.8,8.8.4.4 dhcp-option=option:netmask,255.255.255.0 dhcp-range=::,constructor:${lan-dev}.100,slaac,off-link ''; }; networking.sits.he0 = { dev = wan-dev; local = "74.73.86.185"; remote = "209.51.161.14"; }; networking.iproute2.enable = true; networking.iproute2.rttablesExtraConfig = '' ${toString mullvadMark} mullvad 200 he ''; networking.localCommands = '' ip -6 rule add from 2001:470:8e2e::/48 lookup he prio 0 || true ip -6 route flush cache ip -6 route replace default dev he0 src 2001:470:8e2e:20::d table he ip -6 route flush cache ip route flush cache ip rule add fwmark ${toString mullvadMark} table mullvad ip route replace default dev mullvad table mullvad ip route flush cache ''; # boot.kernel.sysctl."net.ipv6.conf.${wan-dev}.disable_ipv6" = true; networking.interfaces.${wan-dev} = { macAddress = "3c:97:0e:19:7e:5c"; useDHCP = true; }; networking.interfaces.he0.ipv6 = { addresses = [ { address = "2001:470:1f06:1195::2"; prefixLength = 64; } { address = "2001:470:8e2e:20::d"; prefixLength = 64; } ]; # routes = [{ address = "::"; prefixLength = 0; }]; }; networking.interfaces."${lan-dev}".useDHCP = false; networking.interfaces."${lan-dev}.255".useDHCP = true; networking.interfaces."${lan-dev}.100" = { ipv4.addresses = [ { address = "10.65.30.1"; prefixLength = 24; } ]; useDHCP = false; }; networking.interfaces."${lan-dev}.30" = { ipv4.addresses = [ { address = "10.64.30.1"; prefixLength = 23; } ]; useDHCP = false; }; }