all repos — nixfiles @ 903708365692bc5d023c732a3e07ab28860080b1

System and user configuration, managed by nix and home-manager

router: enable access to modem in half-bridge mode

Alin
commit

903708365692bc5d023c732a3e07ab28860080b1

parent

20139e92e03de73cf3787279bd250f2129989b3a

1 file changed, 35 insertions(+), 5 deletions(-)

changed files
M system/roles/router.nix → system/roles/router.nix
@@ -14,6 +14,13 @@ inherit (config.networking) domain hostName;
 
   wanPrefixLen = 56;
 
+  modem = {
+    hostname = "modem";
+
+    deviceAddr = "192.168.100.1";
+    ourAddr = "192.168.100.10";
+  };
+
   nameservers = [
     "2620:fe::fe"
     "2620:fe::9"

@@ -26,22 +33,46 @@ {
   networking = {
     useDHCP = false;
     hosts = {
-      "192.168.100.1" = [
-        "modem.home.arpa"
+      "${modem.deviceAddr}" = [
+        "${modem.hostname}.${domain} ${modem.hostname}"
       ];
     };
     nameservers = lib.mkForce [ "::1" ];
 
     nat = {
-      enable = true;
+      # TODO upstream changes somehow
+      enable = false; # NixOS module is a bit limiting
     };
     firewall = {
       enable = true;
       trustedInterfaces = lans;
       filterForward = true;
+      extraForwardRules = ''
+        iifname "${lan}"  oifname "${wan}" accept comment "from internal interfaces"
+      '';
     };
     nftables = {
       enable = true;
+      tables = {
+        nat = {
+          family = "ip";
+          content = ''
+            chain pre {
+              type nat hook prerouting priority dstnat; policy accept;
+            }
+
+            chain post {
+              type nat hook postrouting priority srcnat; policy accept;
+              iifname "${lan}" oifname "${wan}" ip daddr ${modem.deviceAddr}/24 snat to ${modem.ourAddr} comment "half-bridge modem access";
+              iifname "${lan}" oifname "${wan}" masquerade comment "from internal interfaces"
+            }
+
+            chain out {
+              type nat hook output priority mangle; policy accept;
+            }
+          '';
+        };
+      };
     };
   };
 

@@ -116,8 +147,7 @@ UseDNS = false;
         };
         addresses = [
           {
-            Address = "192.168.100.10/24";
-            Peer = "192.168.100.1/32";
+            Address = "${modem.ourAddr}/24";
             Label = "${wan}:0";
             Scope = "link";
           }