clerie/vcp-bula-nixfiles
1
0
Fork 0
Code Releases Activity

pre-router: clean up config and tune some settings to find out mtu issues and realise it was policy routing

Browse Source
This commit is contained in:
clerie 2022-07-20 11:34:27 +02:00
parent 48ce5d9886
commit c6e03d86fb
3 changed files with 57 additions and 72 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

59
hosts/pre-router/configuration.nix
View File

@ -4,8 +4,6 @@
imports =
[ # Include the results of the hardware scan.
./hardware-configuration.nix
./router.nix
./ipv6.nix
./nginx.nix
];
@ -22,6 +20,63 @@
#networking.interfaces.ens18.useDHCP = false;
#networking.interfaces.ens19.useDHCP = false;
environment.systemPackages = with pkgs; [
ethtool # manage NIC settings (offload, NIC feeatures, ...)
conntrack-tools # view network connection states
wireguard-tools
];
networking.nat = {
enable = true;
externalInterface = "ens18";
internalIPs = [
"10.42.0.0/16"
];
};
boot.kernel.sysctl = {
"net.ipv6.conf.all.forwarding" = true;
"net.ipv6.conf.default.forwarding" = true;
};
networking.interfaces.ens18.useDHCP = true;
networking.interfaces.ens19.useDHCP = false;
networking.interfaces.ens19.ipv6.addresses = [
{ address = "fd00:10:42:10::25"; prefixLength = 64; }
{ address = "2a01:4f8:1c0c:8221::25"; prefixLength = 64; }
];
networking.interfaces.ens19.ipv4.addresses = [
{ address = "10.42.10.25"; prefixLength = 24; }
];
networking.wireguard = {
enable = true;
interfaces = {
wg0 = {
ips = [ "fe80::42:10:1/64" ];
privateKeyFile = "/var/src/secrets/wireguard/wg0";
allowedIPsAsRoutes = false;
peers = [{
publicKey = "Y++eB9SfU17zB4mJ/6AaN761tngXAyTNoVaPNKmuvls=";
allowedIPs = [ "::/0" ];
endpoint = "78.47.183.82:51876";
#endpoint = "gatekeeper.net.clerie.de:51876";
persistentKeepalive = 25;
}];
};
};
};
networking.localCommands = ''
ip -6 route add default dev wg0 table 100
'';
clerie.policyrouting.enable = true;
clerie.policyrouting.rules6 = [
{ rule = "lookup main suppress_prefixlength 0"; prio = 10000; }
{ rule = "from 2a01:4f8:1c0c:8221::/64 lookup 100"; prio = 19000; }
];
# This value determines the NixOS release from which the default
# settings for stateful data, like file locations and database versions
# on your system were taken. It‘s perfectly fine and recommended to leave

41
hosts/pre-router/ipv6.nix
View File

@ -1,41 +0,0 @@
{ config, pkgs, ...}:
{
environment.systemPackages = with pkgs; [
wireguard-tools
];
networking = {
firewall.allowedUDPPorts = [ 51820 ];
firewall.trustedInterfaces = [ "ens19"];
iproute2.enable = true;
iproute2.rttablesExtraConfig = ''
100 PUBLIC6
'';
wireguard.enable = true;
wireguard.interfaces = {
wg0 = {
ips = [ "fe80::42:10:1/64" ];
privateKeyFile = "/var/src/secrets/wireguard/wg0";
listenPort = 51820;
allowedIPsAsRoutes = false;
postSetup = ''
ip -6 rule add from 2a01:4f8:1c0c:8221::/64 lookup PUBLIC6
ip -6 route add default via fe80::1 dev wg0 table PUBLIC6
'';
peers = [{
publicKey = "Y++eB9SfU17zB4mJ/6AaN761tngXAyTNoVaPNKmuvls=";
allowedIPs = [ "::/0" ];
endpoint = "78.47.183.82:51876";
#endpoint = "gatekeeper.net.clerie.de:51876";
persistentKeepalive = 25;
}];
};
};
};
boot.kernel.sysctl."net.ipv6.conf.all.forwarding" = 1;
networking.interfaces.ens19.ipv6.addresses = [
{ address = "fd00:10:42:10::25"; prefixLength = 64; }
{ address = "2a01:4f8:1c0c:8221::25"; prefixLength = 64; }
];
}

29
hosts/pre-router/router.nix
View File

@ -1,29 +0,0 @@
{ config, pkgs, ...}:
{
environment.systemPackages = with pkgs; [
ethtool # manage NIC settings (offload, NIC feeatures, ...)
conntrack-tools # view network connection states
];
networking.firewall.interfaces.ens19.allowedUDPPorts = [ 67 53 ];
networking = {
nameservers = [ "10.42.10.8" "2a01:4f8:1c0c:8221::8" ];
nat = {
enable = true;
externalInterface = "ens18";
internalInterfaces = [ "ens19" ];
};
interfaces = {
ens19.useDHCP = false;
ens18.useDHCP = true;
# Handle the VLANs
ens19 = {
ipv4.addresses = [
{ address = "10.42.10.25"; prefixLength = 24; }
];
};
};
};
}