clerie/vcp-bula-nixfiles
1
0
Fork 0
Code Releases Activity

router, pre-router: move wireguard tunnel and change default route for router

Browse Source
This commit is contained in:
clerie 2022-07-26 14:40:07 +02:00
parent 30cd7a9f39
commit 86b45bae8e
5 changed files with 34 additions and 38 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
hosts/pre-router/configuration.nix
View File

@ -55,34 +55,6 @@
{ address = "10.42.0.0"; prefixLength = 16; via = "10.42.10.1"; }
];
networking.wireguard = {
enable = true;
interfaces = {
wg0 = {
ips = [ "fe80::42:10:1/64" ];
privateKeyFile = "/var/src/secrets/wireguard/wg0";
allowedIPsAsRoutes = false;
peers = [{
publicKey = "Y++eB9SfU17zB4mJ/6AaN761tngXAyTNoVaPNKmuvls=";
allowedIPs = [ "::/0" ];
endpoint = "78.47.183.82:51876";
#endpoint = "gatekeeper.net.clerie.de:51876";
persistentKeepalive = 25;
}];
};
};
};
networking.localCommands = ''
ip -6 route add default dev wg0 table 100
'';
clerie.policyrouting.enable = true;
clerie.policyrouting.rules6 = [
{ rule = "lookup main suppress_prefixlength 0"; prio = 10000; }
{ rule = "from 2a01:4f8:1c0c:8221::/64 lookup 100"; prio = 19000; }
];
# This value determines the NixOS release from which the default
# settings for stateful data, like file locations and database versions
# on your system were taken. It‘s perfectly fine and recommended to leave

26
hosts/router/10-net-services.nix
View File

@ -6,6 +6,32 @@
interface = "ens18";
};
networking.wireguard = {
enable = true;
interfaces = {
wg-services = {
ips = [ "fe80::42:10:1/64" ];
privateKeyFile = "/var/src/secrets/wireguard/wg-services";
allowedIPsAsRoutes = false;
peers = [{
publicKey = "Y++eB9SfU17zB4mJ/6AaN761tngXAyTNoVaPNKmuvls=";
allowedIPs = [ "::/0" ];
endpoint = "78.47.183.82:51876";
#endpoint = "gatekeeper.net.clerie.de:51876";
persistentKeepalive = 25;
}];
};
};
};
networking.localCommands = ''
ip -6 route add default dev wg-services table 20003
'';
clerie.policyrouting.rules6 = [
{ rule = "from 2a01:4f8:1c0c:8221::/64 lookup 20003"; prio = 19000; }
];
networking.interfaces.net-services.ipv4.addresses = [
{ address = "10.42.10.1"; prefixLength = 24; }
{ address = "10.42.10.2"; prefixLength = 24; }

3
hosts/router/configuration.nix
View File

@ -34,9 +34,6 @@
networking.hostName = "router";
networking.defaultGateway = { address = "10.42.10.25"; interface = "net-services"; };
networking.defaultGateway6 = { address = "2a01:4f8:1c0c:8221::25"; interface = "net-services"; };
networking.firewall.checkReversePath = false;
services.prometheus.exporters.node = {

8
hosts/router/ppp.nix
View File

@ -14,10 +14,12 @@
ppp-uplink-a)
${pkgs.iproute2}/bin/ip route flush table 20001 || true
${pkgs.iproute2}/bin/ip route add default dev ppp-uplink-a table 20001
${pkgs.iproute2}/bin/ip route replace default dev ppp-uplink-a metric 2000
;;
ppp-uplink-b)
${pkgs.iproute2}/bin/ip route flush table 20002 || true
${pkgs.iproute2}/bin/ip route add default dev ppp-uplink-b table 20002
${pkgs.iproute2}/bin/ip route replace default dev ppp-uplink-b metric 1000
;;
esac
'';
@ -30,9 +32,11 @@
case $1 in
ppp-uplink-a)
${pkgs.iproute2}/bin/ip route flush table 20001 || true
${pkgs.iproute2}/bin/ip route delete default dev ppp-uplink-a || true
;;
ppp-uplink-b)
${pkgs.iproute2}/bin/ip route flush table 20002 || true
${pkgs.iproute2}/bin/ip route delete default dev ppp-uplink-b || true
;;
esac
'';
@ -46,10 +50,12 @@
ppp-uplink-a)
${pkgs.iproute2}/bin/ip -6 route flush table 20001 || true
${pkgs.iproute2}/bin/ip -6 route add default dev ppp-uplink-a table 20001
${pkgs.iproute2}/bin/ip -6 route replace default dev ppp-uplink-a metric 2000
;;
ppp-uplink-b)
${pkgs.iproute2}/bin/ip -6 route flush table 20002 || true
${pkgs.iproute2}/bin/ip -6 route add default dev ppp-uplink-b table 20002
${pkgs.iproute2}/bin/ip -6 route replace default dev ppp-uplink-b metric 1000
;;
esac
'';
@ -62,9 +68,11 @@
case $1 in
ppp-uplink-a)
${pkgs.iproute2}/bin/ip -6 route flush table 20001 || true
${pkgs.iproute2}/bin/ip -6 route delete default dev ppp-uplink-a || true
;;
ppp-uplink-b)
${pkgs.iproute2}/bin/ip -6 route flush table 20002 || true
${pkgs.iproute2}/bin/ip -6 route delete default dev ppp-uplink-b || true
;;
esac
'';

7
hosts/router/uplink-selector.nix
View File

@ -1,14 +1,7 @@
{ config, pkgs, ... }:
{
networking.localCommands = ''
ip -6 route add default via 2a01:4f8:1c0c:8221::25 dev net-services table 20003
'';
clerie.policyrouting.enable = true;
clerie.policyrouting.rules6 = [
{ rule = "from 2a01:4f8:1c0c:8221::/64 lookup 20003"; prio = 19000; }
];
clerie.uplink-selector.enable = true;
clerie.uplink-selector.uplinks = {