clerie
/
vcp-bula-nixfiles
1
0
Fork 0
Code Releases Activity

Prepare source routing

This commit is contained in:
clerie 2022-07-15 01:16:51 +02:00
parent 438e3f7099
commit c282f5e1f4
20 changed files with 223 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
hosts/router/10-net-services.nix
View File

@ -14,4 +14,6 @@
];
# Everyone is allowed reaching this, no firewall therefore
clerie.uplink-selector.interfaces.net-services.uplink = "uplink-a";
}

2
hosts/router/101-net-uplink-a.nix
View File

@ -25,7 +25,7 @@
lcp-echo-failure 3
mtu 1492
hide-password
defaultroute
nodefaultroute
+ipv6
debug
'';

2
hosts/router/102-net-uplink-b.nix
View File

@ -25,7 +25,7 @@
lcp-echo-failure 3
mtu 1492
hide-password
defaultroute
nodefaultroute
+ipv6
debug
'';

2
hosts/router/151-net-technik-iot.nix
View File

@ -40,4 +40,6 @@
# Give technik access to their toys
{ incomingInterface = "net-technik"; }
];
clerie.uplink-selector.interfaces.net-technik-iot.uplink = "uplink-b";
}

2
hosts/router/201-net-ikt.nix
View File

@ -52,4 +52,6 @@
# Allow infrastructure devices to access ikt user devices for downloading software etc
{ incomingInterface = "net-management"; }
];
clerie.uplink-selector.interfaces.net-ikt.uplink = "uplink-b";
}

2
hosts/router/202-net-technik.nix
View File

@ -53,4 +53,6 @@
# Give the toys access to technik
{ incomingInterface = "net-technik-iot"; }
];
clerie.uplink-selector.interfaces.net-technik.uplink = "uplink-b";
}

2
hosts/router/203-net-hospital.nix
View File

@ -51,4 +51,6 @@
clerie.forward-filter.interfaces.net-hospital.rules = [
{ incomingInterface = "net-ikt"; }
];
clerie.uplink-selector.interfaces.net-hospital.uplink = "uplink-a";
}

2
hosts/router/204-net-zoll.nix
View File

@ -51,4 +51,6 @@
clerie.forward-filter.interfaces.net-zoll.rules = [
{ incomingInterface = "net-ikt"; }
];
clerie.uplink-selector.interfaces.net-zoll.uplink = "uplink-a";
}

2
hosts/router/205-net-leitstelle.nix
View File

@ -51,4 +51,6 @@
clerie.forward-filter.interfaces.net-leitstelle.rules = [
{ incomingInterface = "net-ikt"; }
];
clerie.uplink-selector.interfaces.net-leitstelle.uplink = "uplink-a";
}

2
hosts/router/206-net-verwaltung.nix
View File

@ -51,4 +51,6 @@
clerie.forward-filter.interfaces.net-verwaltung.rules = [
{ incomingInterface = "net-ikt"; }
];
clerie.uplink-selector.interfaces.net-verwaltung.uplink = "uplink-a";
}

2
hosts/router/208-net-yolo.nix
View File

@ -51,4 +51,6 @@
clerie.forward-filter.interfaces.net-yolo.rules = [
{ incomingInterface = "net-ikt"; }
];
clerie.uplink-selector.interfaces.net-yolo.uplink = "uplink-b";
}

2
hosts/router/209-net-infojurte.nix
View File

@ -51,4 +51,6 @@
clerie.forward-filter.interfaces.net-infojurte.rules = [
{ incomingInterface = "net-ikt"; }
];
clerie.uplink-selector.interfaces.net-infojurte.uplink = "uplink-b";
}

2
hosts/router/210-net-internation.nix
View File

@ -51,4 +51,6 @@
clerie.forward-filter.interfaces.net-internation.rules = [
{ incomingInterface = "net-ikt"; }
];
clerie.uplink-selector.interfaces.net-internation.uplink = "uplink-b";
}

2
hosts/router/211-net-programmtre.nix
View File

@ -51,4 +51,6 @@
clerie.forward-filter.interfaces.net-programmtre.rules = [
{ incomingInterface = "net-ikt"; }
];
clerie.uplink-selector.interfaces.net-programmtre.uplink = "uplink-b";
}

2
hosts/router/212-net-open-office.nix
View File

@ -51,4 +51,6 @@
clerie.forward-filter.interfaces.net-open-office.rules = [
{ incomingInterface = "net-ikt"; }
];
clerie.uplink-selector.interfaces.net-open-office.uplink = "uplink-b";
}

2
hosts/router/configuration.nix
View File

@ -6,6 +6,8 @@
./hardware-configuration.nix
./nat.nix
./ppp.nix
./uplink-selector.nix
./10-net-services.nix
./42-net-management.nix

69
hosts/router/ppp.nix Normal file
View File

@ -0,0 +1,69 @@
{ config, pkgs, ... }:
{
# Setting default routes based on interfaces in different tables
environment.etc."ppp/ip-up" = {
text = ''
#! ${pkgs.runtimeShell} -e
case $IFNAME in
ppp-uplink-a)
ip route flush table 20001 || true
ip route add default dev ppp-uplink-a table 20001
;;
ppp-uplink-b)
ip route flush table 20002 || true
ip route add default dev ppp-uplink-b table 20002
;;
esac
'';
mode = "555";
};
environment.etc."ppp/ip-down" = {
text = ''
#! ${pkgs.runtimeShell} -e
case $IFNAME in
ppp-uplink-a)
ip route flush table 20001 || true
;;
ppp-uplink-b)
ip route flush table 20002 || true
;;
esac
'';
mode = "555";
};
environment.etc."ppp/ipv6-up" = {
text = ''
#! ${pkgs.runtimeShell} -e
case $IFNAME in
ppp-uplink-a)
ip -6 route flush table 20001 || true
ip -6 route add default dev ppp-uplink-a table 20001
;;
ppp-uplink-b)
ip -6 route flush table 20002 || true
ip -6 route add default dev ppp-uplink-b table 20002
;;
esac
'';
mode = "555";
};
environment.etc."ppp/ipv6-down" = {
text = ''
#! ${pkgs.runtimeShell} -e
case $IFNAME in
ppp-uplink-a)
ip -6 route flush table 20001 || true
;;
ppp-uplink-b)
ip -6 route flush table 20002 || true
;;
esac
'';
mode = "555";
};
}

9
hosts/router/uplink-selector.nix Normal file
View File

@ -0,0 +1,9 @@
{ config, pkgs, ... }:
{
clerie.uplink-selector.enable = true;
clerie.uplink-selector.uplinks = {
uplink-a.table = "20001";
uplink-b.table = "20002";
};
}

1
modules/default.nix
View File

@ -4,6 +4,7 @@
imports = [
./yate
./forward-filter
./uplink-selector
./fieldpoc
];
}

114
modules/uplink-selector/default.nix Normal file
View File

@ -0,0 +1,114 @@
{ config, lib, pkgs, ... }:
with lib;
let
cfg = config.clerie.uplink-selector;
startScript = pkgs.writeScriptBin "uplink-selector-start" ''
#! ${pkgs.runtimeShell} -e
ip46() {
ip "$@"
ip -6 "$@"
}
ip46 rule flush || true
# Route everything except default route first
ip46 rule add lookup main suppress_prefixlength 0 prio 10000
# Decide which uplink to use
${concatStrings (mapAttrsToList (iface: ifacecfg: ''
ip46 rule add iif ${iface} lookup ${cfg.uplinks.${ifacecfg.uplink}.table} prio 20000
'') cfg.interfaces)}
# Fallback to the main default table
ip46 rule add lookup main prio 32000
'';
stopScript = pkgs.writeScriptBin "uplink-selector-stop" ''
#! ${pkgs.runtimeShell} -e
ip rule flush || true
ip -6 rule flush || true
'';
in
{
options = {
clerie.uplink-selector = {
enable = mkOption {
type = types.bool;
default = false;
description =
''
Select a default gateway for each interface manually
'';
};
uplinks = mkOption {
default = { };
type = with types; attrsOf (submodule {
options = {
table = mkOption {
type = types.str;
example = "5001";
description = "Route table containing the gateway route of this uplink";
};
};
});
description =
''
Uplink interface name
'';
};
interfaces = mkOption {
default = { };
type = with types; attrsOf (submodule {
options = {
uplink = mkOption {
type = types.nullOr types.str;
example = "uplink-a";
description = "Name of the uplink that should used as a default gateway by this interface";
};
};
});
description =
''
Interface
'';
};
};
};
config = mkIf cfg.enable {
environment.systemPackages = [ pkgs.iproute2 ];
systemd.services.uplink-selector = {
description = "Uplink Selector";
before = [ "network.target" ];
wantedBy = [ "network.target" ];
after = [ "network-pre.target" ];
path = [ pkgs.iproute2 ];
unitConfig.ConditionCapability = "CAP_NET_ADMIN";
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
ExecStart = "@${startScript}/bin/uplink-selector-start uplink-selector-start";
ExecStop = "@${stopScript}/bin/uplink-selector-stop uplink-selector-stop";
};
};
};
}