{ config, pkgs, lib, ... }: { imports = [ ./hardware-configuration.nix ../../configuration/common ../../configuration/proxmox-vm ../../configuration/dn42 ../../modules/policyrouting ]; boot.loader.grub.enable = true; boot.loader.grub.version = 2; boot.loader.grub.device = "/dev/vda"; networking.hostName = "dn42-il-gw1"; networking.useDHCP = false; networking.interfaces.lo.ipv6.addresses = [ { address = "fd56:4902:eca0:1::1"; prefixLength = 64; } ]; # VM Nat Netz mercury networking.interfaces.ens18.ipv4.addresses = [ { address = "192.168.10.23"; prefixLength = 24; } ]; # OSPF Netz networking.interfaces.ens19 = {}; # IPv6 Uplink networking.interfaces.ens20.ipv6.addresses = [ { address = "2001:638:904:ffc9::7"; prefixLength = 64; } ]; networking.defaultGateway = { address = "192.168.10.1"; interface = "ens18"; }; networking.defaultGateway6 = { address = "2001:638:904:ffc9::1"; interface = "ens20"; }; networking.nameservers = [ "2001:638:904:ffcc::3" "2001:638:904:ffcc::4" "141.24.40.3" "141.24.40.4" ]; networking.wireguard.enable = true; networking.wireguard.interfaces = { # n0emis wg0197 = { ips = [ "fe80::42:1/128" # peer fe80::42:42:1/128 ]; postSetup = '' ip -6 route flush dev wg0197 ip addr del dev wg0197 fe80::42:1/128 && ip addr add dev wg0197 fe80::42:1/128 peer fe80::42:42:1/128 ''; listenPort = 50197; allowedIPsAsRoutes = false; peers = [ { allowedIPs = [ "fe80::/10" "fd00::/8" ]; endpoint = "himalia.dn42.n0emis.eu:52574"; publicKey = "ObF+xGC6DdddJer0IUw6nzC0RqzeKWwEiQU0ieowzhg="; } ]; privateKeyFile = "/var/src/secrets/wireguard/wg0197"; }; # e1mo wg0565 = { ips = [ "fe80::43:43:1/128" # peer fe80::43:1/128 ]; postSetup = '' ip -6 route flush dev wg0565 ip addr del dev wg0565 fe80::43:43:1/128 && ip addr add dev wg0565 fe80::43:43:1/128 peer fe80::43:1/128 ''; listenPort = 50565; allowedIPsAsRoutes = false; peers = [ { allowedIPs = [ "fe80::/10" "fd00::/8" ]; endpoint = "de-fra1.dn42.net.dont-break.it:22574"; publicKey = "shGS36iaWgcJL1FVLhZHPxLHkPETIy2FFdgmNyx1DSk="; } ]; privateKeyFile = "/var/src/secrets/wireguard/wg0565"; }; # fooker wg1271 = { ips = [ "fe80::1/128" # peer fe80::2/128 ]; postSetup = '' ip -6 route flush dev wg1271 ip addr del dev wg1271 fe80::1/128 && ip addr add dev wg1271 fe80::1/128 peer fe80::2/128 ''; listenPort = 51271; allowedIPsAsRoutes = false; peers = [ { allowedIPs = [ "fe80::/10" "fd00::/8" ]; endpoint = "north.zitadelle.dev.open-desk.net:23425"; publicKey = "xxPjHWVzePinOOMnuhwGAI3PKY9pvpifIvIbPu3IwQw="; } ]; privateKeyFile = "/var/src/secrets/wireguard/wg1271"; }; wg1272 = { ips = [ "fe80::1:1/128" # peer fe80::1:2/128 ]; postSetup = '' ip -6 route flush dev wg1272 ip addr del dev wg1272 fe80::1:1/128 && ip addr add dev wg1272 fe80::1:1/128 peer fe80::1:2/128 ''; listenPort = 51272; allowedIPsAsRoutes = false; peers = [ { allowedIPs = [ "fe80::/10" "fd00::/8" ]; endpoint = "south.zitadelle.dev.open-desk.net:23425"; publicKey = "Iae2R4B7VVsloKWK8T1j1vLMuxpP4dVDUdzEg/YpAjE="; } ]; privateKeyFile = "/var/src/secrets/wireguard/wg1272"; }; # margau wg1280 = { ips = [ "fde3:4c0d:2836:ff00::21/127" # peer fde3:4c0d:2836:ff00::20/127 ]; listenPort = 51280; allowedIPsAsRoutes = false; peers = [ { allowedIPs = [ "fe80::/10" "fd00::/8" ]; endpoint = "wg1.margau.ipv6.church:51830"; publicKey = "CEge9jdHQArzdniUiWyB3IUZOjGiew3gPmz/MOf4ahU="; } ]; privateKeyFile = "/var/src/secrets/wireguard/wg1280"; }; # perflyst wg1302 = { ips = [ "fe80::a14e/128" # peer fe80::a14d/128 ]; postSetup = '' ip -6 route flush dev wg1302 ip addr del dev wg1302 fe80::a14e/128 && ip addr add dev wg1302 fe80::a14e/128 peer fe80::a14d/128 ''; listenPort = 51302; allowedIPsAsRoutes = false; peers = [ { allowedIPs = [ "fe80::/10" "fd00::/8" ]; endpoint = "[2a03:4000:6:f6ed::1]:22574"; publicKey = "TSPvvpMY8dCFk6gd58aYtkibtqUn8EzIF6dXP52b3y8="; } ]; privateKeyFile = "/var/src/secrets/wireguard/wg1302"; }; }; petabyte.policyrouting = { enable = true; rules6 = [ { rule = "from all to fd56:4902:eca0::/48 lookup 1337"; prio = 10000; } { rule = "from all to all lookup 2342"; prio = 10000; } { rule = "from all to fd56:4902:eca0::/48 unreachable"; prio = 20000; } { rule = "from fd56:4902:eca0::/48 to all unreachable"; prio = 20000; } ]; }; services.bird2.enable = true; services.bird2.config = '' router id ${ (lib.head config.networking.interfaces.ens18.ipv4.addresses).address }; ipv6 table ospf6; ipv6 table bgp6; protocol direct { interface "lo"; ipv6 { table ospf6; }; } protocol static { ipv6 { table bgp6; }; route fd56:4902:eca0::/48 via "lo"; route fd56:4902:eca0::/52 via "lo"; } protocol kernel { ipv6 { table ospf6; export filter { krt_prefsrc=fd56:4902:eca0:1::1; accept; }; import none; }; kernel table 1337; } protocol kernel { ipv6 { table bgp6; export filter { krt_prefsrc=fd56:4902:eca0:1::1; accept; }; import none; }; kernel table 2342; } protocol ospf v3 { ipv6 { table ospf6; import all; export all; }; area 0 { interface "ens19" { cost 80; }; }; } protocol bgp gw5 { local as 4242422574; graceful restart on; neighbor fd56:4902:eca0:5::1 as 4242422574; source address fd56:4902:eca0:1::1; ipv6 { table bgp6; igp table ospf6; next hop self; import keep filtered; import all; export all; }; } protocol bgp gw6 { local as 4242422574; graceful restart on; neighbor fd56:4902:eca0:6::1 as 4242422574; source address fd56:4902:eca0:1::1; ipv6 { table bgp6; igp table ospf6; next hop self; import keep filtered; import all; export all; }; } template bgp bgp_peer { local as 4242422574; graceful restart on; ipv6 { table bgp6; next hop self; import keep filtered; import filter { if net ~ [fd00::/8{48,64}] then accept; reject; }; export filter { if net ~ [fd00::/8{48,64}] then accept; reject; }; }; } protocol bgp peer_0197_himalia from bgp_peer { neighbor fe80::42:42:1%wg0197 as 4242420197; source address fe80::42:1; } protocol bgp peer_0565 from bgp_peer { neighbor fe80::43:1%wg0565 as 4242420565; source address fd80::43:43:1; } protocol bgp peer_1271_north from bgp_peer { neighbor fe80::2%wg1271 as 4242421271; source address fe80::1; } protocol bgp peer_1271_south from bgp_peer { neighbor fe80::1:2%wg1272 as 4242421271; source address fe80::1:1; } protocol bgp peer_1280_wg1 from bgp_peer { neighbor fde3:4c0d:2836:ff00::20%wg1280 as 4242421280; source address fde3:4c0d:2836:ff00::21; } protocol bgp peer_1302 from bgp_peer { neighbor fe80::a14d%wg1302 as 4242421302; source address fe80::a14e; } protocol device { scan time 10; } ''; system.stateVersion = "21.03"; }