clerie/nixfiles
1
0
Fork 0
Code Activity

hosts/carbon: Remove network bridges

Browse Source
This commit is contained in:
clerie
2025-12-15 22:30:56 +01:00
parent 398fcc74b7
commit 93107849d1
3 changed files with 20 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
hosts/carbon/net-iot.nix
View File

@@ -6,22 +6,19 @@
id = 205; id = 205;
interface = "enp1s0"; interface = "enp1s0";
}; };
networking.bridges."net-iot".interfaces = [ networking.interfaces."enp1s0.205".ipv6.addresses = [
"enp1s0.205"
];
networking.interfaces."net-iot".ipv6.addresses = [
{ address = "fe80::1"; prefixLength = 64; } { address = "fe80::1"; prefixLength = 64; }
{ address = "fd00:152:152:205::1"; prefixLength = 64; } { address = "fd00:152:152:205::1"; prefixLength = 64; }
]; ];
networking.interfaces."net-iot".ipv4.addresses = [ networking.interfaces."enp1s0.205".ipv4.addresses = [
{ address = "10.152.205.1"; prefixLength = 24; } { address = "10.152.205.1"; prefixLength = 24; }
]; ];
# Enable NTP # Enable NTP
networking.firewall.interfaces."net-iot".allowedUDPPorts = [ 123 ]; networking.firewall.interfaces."enp1s0.205".allowedUDPPorts = [ 123 ];
services.radvd.config = '' services.radvd.config = ''
interface net-iot { interface enp1s0.205 {
AdvSendAdvert on; AdvSendAdvert on;
MaxRtrAdvInterval 30; MaxRtrAdvInterval 30;
prefix ::/64 { prefix ::/64 {
@@ -36,7 +33,7 @@
services.kea.dhcp4 = { services.kea.dhcp4 = {
settings = { settings = {
interfaces-config = { interfaces-config = {
interfaces = [ "net-iot" ]; interfaces = [ "enp1s0.205" ];
}; };
subnet4 = [ subnet4 = [
{ {
@@ -72,9 +69,9 @@
clerie.firewall.extraForwardFilterCommands = '' clerie.firewall.extraForwardFilterCommands = ''
# Allow access from Heimnetz to IOT devices # Allow access from Heimnetz to IOT devices
ip46tables -A forward-filter -i net-heimnetz -o net-iot -j ACCEPT ip46tables -A forward-filter -i enp2s0 -o enp1s0.205 -j ACCEPT
ip46tables -A forward-filter -i net-iot -j DROP ip46tables -A forward-filter -i enp1s0.205 -j DROP
ip46tables -A forward-filter -o net-iot -j DROP ip46tables -A forward-filter -o enp1s0.205 -j DROP
''; '';
} }

17
hosts/carbon/net-mgmt.nix
View File

@@ -6,19 +6,16 @@
id = 203; id = 203;
interface = "enp1s0"; interface = "enp1s0";
}; };
networking.bridges."net-mgmt".interfaces = [ networking.interfaces."enp1s0.203".ipv6.addresses = [
"enp1s0.203"
];
networking.interfaces."net-mgmt".ipv6.addresses = [
{ address = "fe80::1"; prefixLength = 64; } { address = "fe80::1"; prefixLength = 64; }
{ address = "fd00:152:152:203::1"; prefixLength = 64; } { address = "fd00:152:152:203::1"; prefixLength = 64; }
]; ];
networking.interfaces."net-mgmt".ipv4.addresses = [ networking.interfaces."enp1s0.203".ipv4.addresses = [
{ address = "10.152.203.1"; prefixLength = 24; } { address = "10.152.203.1"; prefixLength = 24; }
]; ];
services.radvd.config = '' services.radvd.config = ''
interface net-mgmt { interface enp1s0.203 {
AdvSendAdvert on; AdvSendAdvert on;
MaxRtrAdvInterval 30; MaxRtrAdvInterval 30;
prefix ::/64 { prefix ::/64 {
@@ -31,7 +28,7 @@
services.kea.dhcp4 = { services.kea.dhcp4 = {
settings = { settings = {
interfaces-config = { interfaces-config = {
interfaces = [ "net-mgmt" ]; interfaces = [ "enp1s0.203" ];
}; };
subnet4 = [ subnet4 = [
{ {
@@ -55,9 +52,9 @@
clerie.firewall.extraForwardFilterCommands = '' clerie.firewall.extraForwardFilterCommands = ''
# Allow access from Heimnetz to MGMT network # Allow access from Heimnetz to MGMT network
ip46tables -A forward-filter -i net-heimnetz -o net-mgmt -j ACCEPT ip46tables -A forward-filter -i enp2s0 -o enp1s0.203 -j ACCEPT
ip46tables -A forward-filter -i net-mgmt -j DROP ip46tables -A forward-filter -i enp1s0.203 -j DROP
ip46tables -A forward-filter -o net-mgmt -j DROP ip46tables -A forward-filter -o enp1s0.203 -j DROP
''; '';
} }

17
hosts/carbon/net-printer.nix
View File

@@ -5,17 +5,14 @@
id = 206; id = 206;
interface = "enp1s0"; interface = "enp1s0";
}; };
networking.bridges."net-printer".interfaces = [ networking.interfaces."enp1s0.206".ipv4.addresses = [
"enp1s0.206"
];
networking.interfaces."net-printer".ipv4.addresses = [
{ address = "10.152.206.1"; prefixLength = 24; } { address = "10.152.206.1"; prefixLength = 24; }
]; ];
services.kea.dhcp4 = { services.kea.dhcp4 = {
settings = { settings = {
interfaces-config = { interfaces-config = {
interfaces = [ "net-printer" ]; interfaces = [ "enp1s0.206" ];
}; };
subnet4 = [ subnet4 = [
{ {
@@ -37,15 +34,11 @@
}; };
}; };
# Enable scan-to-gpg
networking.firewall.interfaces."net-printer".allowedTCPPorts = [ 2121 ];
networking.firewall.interfaces."net-printer".allowedTCPPortRanges = [ { from = 2130; to = 2134; } ];
clerie.firewall.extraForwardFilterCommands = '' clerie.firewall.extraForwardFilterCommands = ''
# Allow access from Heimnetz to printer # Allow access from Heimnetz to printer
ip46tables -A forward-filter -i net-heimnetz -o net-printer -j ACCEPT ip46tables -A forward-filter -i enp2s0 -o enp1s0.206 -j ACCEPT
ip46tables -A forward-filter -i net-printer -j DROP ip46tables -A forward-filter -i enp1s0.206 -j DROP
ip46tables -A forward-filter -o net-printer -j DROP ip46tables -A forward-filter -o enp1s0.206 -j DROP
''; '';
} }