@@ -0,0 +1,207 @@
+{
+  config,
+  lib,
+  ...
+}:
+let
+  wan = config.networking.nat.externalInterface;
+  lans = config.networking.nat.internalInterfaces;
+  lan = builtins.head lans;
+  inherit (config.networking) domain hostName;
+
+  dnsmasqEnable = true;
+
+  wanPrefixLen = 56;
+
+  nameservers = [
+    "9.9.9.11"
+    "149.112.112.11"
+    "2620:fe::11"
+    "2620:fe::fe:11"
+  ];
+  nsTLSHostname = "dns11.quad9.net";
+in
+{
+  networking = {
+    useDHCP = false;
+    hosts = {
+      "192.168.100.1" = [
+        "modem"
+        "pyur"
+      ];
+    };
+    inherit nameservers;
+
+    nat = {
+      enable = true;
+    };
+    firewall = {
+      enable = true;
+      trustedInterfaces = lans;
+      filterForward = true;
+    };
+    nftables = {
+      enable = true;
+    };
+  };
+
+  systemd.network = {
+    enable = true;
+    config = {
+      networkConfig = {
+        IPv6Forwarding = true;
+      };
+    };
+    networks = {
+      "40-${lan}" = rec {
+        matchConfig.Name = lan;
+        address = [
+          "10.0.0.1/16"
+          "fd12:d04f:65d:42::1/56"
+          "fe80::1/64"
+        ];
+        networkConfig = {
+          IPv6AcceptRA = false;
+          DHCPPrefixDelegation = true;
+          ConfigureWithoutCarrier = true;
+          MulticastDNS = true;
+          Domains = [ config.networking.domain ];
+          LinkLocalAddressing = false;
+          IPv6SendRA = !dnsmasqEnable;
+          DHCPServer = !dnsmasqEnable;
+          DNS = map (a: builtins.head (lib.strings.splitString "/" a)) address;
+          DNSDefaultRoute = false;
+        };
+        dhcpPrefixDelegationConfig = {
+          UplinkInterface = wan;
+          SubnetId = "42";
+          Assign = true;
+          Token = "::1";
+        };
+      };
+      "40-${wan}" = {
+        matchConfig.Name = wan;
+        networkConfig = {
+          DHCP = true;
+          IPv6AcceptRA = true;
+          IPv4Forwarding = true;
+          MulticastDNS = false;
+          DNSDefaultRoute = true;
+          DNSOverTLS = true;
+          DNS = map (ns: "${ns}#${nsTLSHostname}") config.networking.nameservers;
+        };
+        dhcpV4Config = {
+          UseDNS = false;
+          SendHostname = false;
+          UseHostname = false;
+          Label = "${wan}:1";
+        };
+        dhcpV6Config = {
+          UseDNS = false;
+          SendHostname = false;
+          RapidCommit = true;
+          PrefixDelegationHint = "::/${toString wanPrefixLen}";
+        };
+        dhcpPrefixDelegationConfig = {
+          UplinkInterface = ":self";
+        };
+        ipv6AcceptRAConfig = {
+          UseDNS = false;
+        };
+        addresses = [
+          {
+            Address = "192.168.100.10/24";
+            Peer = "192.168.100.1/32";
+            Label = "${wan}:0";
+            Scope = "link";
+          }
+        ];
+        routes = [
+          {
+            Gateway = "_dhcp4";
+            InitialCongestionWindow = 30;
+            InitialAdvertisedReceiveWindow = 30;
+          }
+          {
+            Gateway = "_ipv6ra";
+            InitialCongestionWindow = 30;
+            InitialAdvertisedReceiveWindow = 30;
+          }
+        ];
+        cakeConfig = {
+          Bandwidth = "24M";
+          OverheadBytes = 18;
+          MPUBytes = 64;
+          CompensationMode = "none";
+          NAT = true;
+          RTTSec = "100ms";
+          AckFilter = true;
+          PriorityQueueingPreset = "diffserv8";
+        };
+      };
+    };
+  };
+
+  services.resolved = {
+    enable = true;
+    settings.Resolve = {
+      DNS = [ ];
+      LLMNR = false;
+      MulticastDNS = true;
+    };
+  };
+
+  boot.kernelModules = [
+    "tcp_lp"
+  ];
+  boot.kernel.sysctl = {
+    "net.ipv4.tcp_slow_start_after_idle" = 0;
+    "net.ipv4.tcp_ecn" = 1;
+    "net.ipv4.tcp_fastopen" = "0x3";
+    "net.core.default_qdisc" = "fq";
+
+    "net.ipv6.conf.all.accept_ra" = 0;
+    "net.ipv6.conf.all.autoconf" = 0;
+    "net.ipv6.conf.all.use_tempaddr" = 0;
+
+    # "net.ipv6.conf.${wan}.accept_ra" = 2;
+    "net.ipv6.conf.${wan}.autoconf" = 1;
+  };
+
+  services.dnsmasq = {
+    enable = dnsmasqEnable;
+    alwaysKeepRunning = true;
+    settings = {
+      inherit domain;
+      interface = lan;
+      except-interface = "lo";
+      bind-interfaces = true;
+      dhcp-fqdn = true;
+      dhcp-authoritative = true;
+      dhcp-rapid-commit = true;
+      dhcp-range = [
+        "10.0.1.10,10.0.250.250,48h"
+        "fd12:d04f:65d:42::,slaac,ra-names,48h"
+        "::,constructor:${lan},ra-stateless"
+      ];
+      quiet-dhcp = true;
+      quiet-dhcp6 = true;
+      quiet-ra = true;
+      enable-ra = true;
+
+      cache-size = 0;
+      no-resolv = true;
+      server = [ "127.0.0.53" ];
+
+      expand-hosts = true;
+      localise-queries = true;
+      interface-name = [
+        "${hostName}.${domain},${lan}"
+        "ca.${domain},${lan}"
+        "wan.${domain},${wan}"
+      ];
+    };
+  };
+  systemd.services.dnsmasq.after = [ "network.target" ];
+  systemd.services.dnsmasq.wants = [ "network.target" ];
+}