path: root/config/router.nix

{ config, lib, pkgs, ... }:
let
  wan-dev = "bond0.10";
  lan-dev = "bond0";
  wireguardPorts =
    [ config.orbekk.mullvad.listenPort config.orbekk.nycmesh.listenPort ];
  mullvadMark = 30;
  nycmeshMark = 32;
  aliases = import ../data/aliases.nix;
in {
  orbekk.mullvad.enable = true;
  orbekk.nycmesh.enable = true;

  services.tftpd.enable = true;
  services.openntpd.enable = true;

  networking.useDHCP = false;

  networking.networkmanager.enable = lib.mkForce false;

  networking.nameservers = [ "8.8.8.8" ];

  networking.vlans = builtins.listToAttrs (map (id: {
    name = "${lan-dev}.${toString id}";
    value = {
      inherit id;
      interface = lan-dev;
    };
  }) [ 10 30 32 100 255 ]);

  networking.bonds.bond0 = {
    interfaces = [ "eno1" "eno2" ];
    driverOptions = {
      miimon = "1000";
      mode = "balance-rr";
    };
  };

  systemd.services.update-dynamic-dns = {
    description = "Update dynamic dns records";
    path = with pkgs; [ bash dnsutils nettools gawk iproute curl ];
    startLimitIntervalSec = 5;
    script = toString ../tools/update-dns.sh;
  };

  networking.dhcpcd.runHook = ''
    systemctl restart update-dynamic-dns.service
  '';

  networking.firewall = {
    enable = lib.mkForce false;
    allowedTCPPorts = lib.mkForce [ ];
    allowedUDPPorts = lib.mkForce [ ];
    allowPing = true;
    logRefusedConnections = false;
    checkReversePath = false;
  };

  services.ddclient = {
    enable = true;
    configFile = "/opt/secret/he-ddclient.conf";
  };
  # FIXME: Workaround for ddclient.conf not being available to ddclient.
  systemd.services.ddclient.serviceConfig.DynamicUser = lib.mkForce false;

  services.ferm = {
    enable = true;
    config = ''
      @def $DEV_UNTRUSTED_LAN = (${lan-dev}.30 ${lan-dev}.32);
      @def $DEV_LAN = (${lan-dev}.100);
      @def $DEV_ADMIN = (${lan-dev}.255);
      @def $DEV_WAN = (${wan-dev} he0 mullvad nycmesh);
      @def $NET_LAN = (172.20.0.0/16);

      # Forward dns queries to dnsmasq on LAN interfaces.
      domain (ip ip6) table nat chain PREROUTING {
        interface ($DEV_LAN $DEV_UNTRUSTED_LAN) daddr $NET_LAN proto (tcp udp) dport 53 REDIRECT to-ports 2053;
      }

      domain (ip ip6) table filter {
        chain INPUT {
          policy DROP;

          mod state state INVALID DROP;
          mod state state (ESTABLISHED RELATED) ACCEPT;

          interface lo ACCEPT;
          proto icmp ACCEPT;

          proto (udp udp) dport dhcpv6-client ACCEPT;

          proto 41 ACCEPT;  # IPv6 sit tunnel

          interface ($DEV_WAN $DEV_LAN $DEV_UNTRUSTED_LAN) @subchain "wan_services" {
            # Valheim
            proto udp dport (3400 3401 3402) ACCEPT;

            proto (tcp udp) dport 2053 ACCEPT;
            proto (tcp udp) dport (bootpc bootps) ACCEPT;
            proto tcp dport ssh ACCEPT;
            proto (tcp udp) dport domain ACCEPT;
            proto tcp dport (http https) ACCEPT;
            proto udp dport (${lib.concatStringsSep " " (map toString wireguardPorts)}) ACCEPT;
          }

          interface ($DEV_LAN $DEV_ADMIN) @subchain "lan_services" {
            proto (tcp udp) dport 5000 ACCEPT; # random debugging

            proto (tcp udp) dport (ssh domain bootpc bootps ntp) ACCEPT;
            # prometheus temp rule
            proto tcp dport 11112 ACCEPT;
            proto (tcp udp) dport tftp ACCEPT;

            # RTMP streaming
            proto (tcp udp) dport 1935 ACCEPT;

            # Chromecast
            # proto udp dport 32768:61000 ACCEPT;
            # proto udp dport (5353 1900) ACCEPT;
            # proto tcp dport (8008 8009) ACCEPT;

            interface $DEV_LAN jump logdrop;
          }
        }

        chain OUTPUT policy ACCEPT;

        chain FORWARD {
          policy DROP;

          mod state state INVALID DROP;
          mod state state (ESTABLISHED RELATED) ACCEPT;

          interface $DEV_UNTRUSTED_LAN outerface $DEV_WAN ACCEPT;
          interface $DEV_LAN ACCEPT;

          jump logdrop;
        }
      }

      domain ip6 table filter chain INPUT {
        proto ipv6-icmp ACCEPT;
      }

      domain (ip ip6) table filter chain logdrop {
        LOG log-level warning log-prefix "dropped "; 
        DROP;
      }

      domain (ip ip6) table filter chain INPUT {
        interface $DEV_WAN DROP;
        jump logdrop;
      }

      domain ip table nat {
        chain POSTROUTING {
          saddr $NET_LAN outerface $DEV_WAN MASQUERADE;
        }
      }

      domain (ip ip6) table mangle {
        chain PREROUTING {
          interface ${lan-dev}.30 MARK set-mark ${toString mullvadMark};
        }
      }
      domain ip table mangle {
        chain PREROUTING {
          interface ${lan-dev}.32 MARK set-mark ${toString nycmeshMark};
        }
      }
    '';
  };

  services = {
    openssh.enable = lib.mkDefault true;
    openssh.passwordAuthentication = false;
  };

  boot.kernel.sysctl = {
    "net.ipv4.conf.all.forwarding" = true;
    "net.ipv4.conf.default.forwarding" = true;
    "net.ipv6.conf.all.forwarding" = true;
    "net.ipv6.conf.default.forwarding" = true;
  };

  #services.hostapd = {
  #  enable = true;
  #  # driver = "iwlwifi";
  #  ssid = "2c";
  #  wpaPassphrase = "mintchip";
  #  interface = "${lan-dev}";
  #  hwMode = "g";
  #  channel = 11;
  #  extraConfig = ''
  #    country_code=US
  #    wpa_key_mgmt=WPA-PSK  
  #    rsn_pairwise=CCMP
  #  '';
  #};

  networking.dhcpcd = {
    # Wait for v4 and v6 addresses.
    # wait = "both";
    extraConfig = ''
      debug
      noipv6rs
      interface ${wan-dev}
        dhcp
        ipv6rs
        ia_na 0
        # ia_pd 1/::/64 ${lan-dev}.100/0/64
    '';
  };
  systemd.services.dhcpcd = {
    after = [ "network-addresses-${wan-dev}.service" ];
    preStart = lib.mkAfter ''
      ${pkgs.iproute}/bin/ip link set dev ${wan-dev} address ${
        config.networking.interfaces.${wan-dev}.macAddress
      };
    '';
  };

  services.dnsmasq = {
    enable = true;
    servers = [ "1.1.1.1" "8.8.8.8" "8.8.4.4" ];
    resolveLocalQueries = false;
    extraConfig = ''
      port=2053

      no-resolv
      address=/test-dns.orbekk.com/::1

      enable-ra
      dhcp-authoritative

      # Null AAAA response on these domains
      server=/netflix.com/#
      address=/netflix.com/::
      server=/netflix.net/#
      address=/netflix.net/::
      server=/nflxext.com/#
      address=/nflxext.com/::
      server=/nflximg.net/#
      address=/nflximg.net/::
      server=/nflxvideo.net/#
      address=/nflxvideo.net/::
      server=/nflxso.net/#
      address=/nflxso.net/::

      dhcp-range=vlan30,172.20.30.50,172.20.30.254,5m
      dhcp-option=net:vlan30,option:router,172.20.30.1
      dhcp-option=net:vlan30,option:dns-server,172.20.30.1

      dhcp-range=vlan100,172.20.100.50,172.20.100.254,5m
      dhcp-host=vlan100,d8:3b:bf:59:22:de,172.20.100.10
      dhcp-range=vlan100,::100,::500,constructor:bond0.100,ra-only
      dhcp-option=net:vlan100,option:router,172.20.100.1
      dhcp-option=net:vlan100,option:dns-server,172.20.100.1

      dhcp-range=vlan32,172.20.32.50,172.20.32.254,5m
      dhcp-range=vlan32,::100,::500,constructor:bond0.32,ra-only
      dhcp-option=net:vlan32,option:router,172.20.32.1
      dhcp-option=net:vlan32,option:dns-server,172.20.32.1
    '';
  };

  networking.sits.he0 = {
    dev = wan-dev;
    remote = "209.51.161.14";
  };

  networking.iproute2.enable = true;
  networking.iproute2.rttablesExtraConfig = ''
     ${toString mullvadMark} mullvad
     ${toString nycmeshMark} nycmesh
    200 he
  '';

  systemd.services.network-route-setup = {
    description = "HE tunnel route setup";
    requires = [ "network-online.target" ];
    after = [ "network.target" "network-online.target" ];
    wantedBy = [ "multi-user.target" ];
    path = [ pkgs.iproute ];
    script = ''
      # ip -6 rule add from 2001:470:8e2e::/48 lookup he prio 0 || true
      # ip -6 route replace default dev he0 src 2001:470:8e2e:20::d table he
      # ip -6 route flush cache
    '';
  };

  networking.wireguard.interfaces.mullvad.postSetup = ''
    ip rule add fwmark ${toString mullvadMark} table mullvad
    ip route replace default dev mullvad table mullvad
    ip route flush cache
  '';

  networking.wireguard.interfaces.nycmesh.postSetup = ''
    ip rule add fwmark ${toString nycmeshMark} table nycmesh
    ip route replace default via 10.70.73.1 onlink dev nycmesh table nycmesh
    ip route flush cache
  '';

  # boot.kernel.sysctl."net.ipv6.conf.${wan-dev}.disable_ipv6" = true;

  networking.interfaces.${wan-dev} = {
    macAddress = "3c:97:0e:19:7e:5c";
    useDHCP = true;
  };

  networking.interfaces.he0.ipv6 = {
    addresses = [
      {
        address = "2001:470:1f06:1195::2";
        prefixLength = 64;
      }
      {
        address = "2001:470:8e2e:20::d";
        prefixLength = 64;
      }
    ];
    routes = [{ address = "::"; prefixLength = 0; }];
  };

  networking.interfaces."${lan-dev}".useDHCP = false;
  networking.interfaces."${lan-dev}.255" = {
    ipv4.addresses = [{
      address = "10.10.255.3";
      prefixLength = 24;
    }];
    ipv6.addresses = [{
      address = "2001:470:8e2e:ffff::3";
      prefixLength = 64;
    }];
    useDHCP = false;
  };
  networking.interfaces."${lan-dev}.100" = {
    ipv4.addresses = [{
      address = "172.20.100.1";
      prefixLength = 24;
    }];
    ipv6.addresses = [{
      address = "2001:470:8e2e:100::1";
      prefixLength = 64;
    }];
    useDHCP = false;
  };
  networking.interfaces."${lan-dev}.30" = {
    ipv4.addresses = [{
      address = "172.20.30.1";
      prefixLength = 24;
    }];
    useDHCP = false;
  };
  networking.interfaces."${lan-dev}.32" = {
    ipv4.addresses = [{
      address = "172.20.32.1";
      prefixLength = 23;
    }];
    ipv6.addresses = [{
      address = "2001:470:8e2e:32::1";
      prefixLength = 64;
    }];
    useDHCP = false;
  };
}