blob: 3150b02f989de8ad6694e8dc50c6fee07b91241a (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
|
{
lib,
config,
pkgs,
...
}:
with lib; let
cfg = config.local.net;
in {
options.local.net = with lib.types; {
enable = mkEnableOption "networking stack";
hostname = mkOption {
type = str;
};
dhcpInterface = mkOption {
type = nullOr str;
default = null;
};
};
config = mkIf cfg.enable {
boot.kernel.sysctl = {
# rp_filter=1 reemplazado por nixos-fw-rpfilter
"net.ipv4.conf.all.rp_filter" = mkForce 2;
"net.ipv4.conf.default.rp_filter" = mkForce 2;
"net.ipv4.conf.all.forwarding" = mkForce true;
"net.ipv6.conf.all.forwarding" = mkForce true;
"net.ipv4.conf.default.forwarding" = mkForce true;
"net.ipv6.conf.default.forwarding" = mkForce true;
"net.ipv4.conf.all.accept_redirects" = mkForce false;
"net.ipv6.conf.all.accept_redirects" = mkForce false;
"net.ipv4.conf.default.accept_redirects" = mkForce false;
"net.ipv6.conf.default.accept_redirects" = mkForce false;
};
environment.systemPackages = with pkgs; [
conntrack-tools
dhcpcd
dnsutils
nmap
socat
tcpdump
wireguard-tools
];
networking = {
domain = mkDefault config.local.domains.host.main;
hostName = cfg.hostname;
firewall = {
logReversePathDrops = true;
checkReversePath = "loose";
extraCommands = mkBefore ''
ip46tables -t filter -P INPUT DROP
ip46tables -t filter -P FORWARD ACCEPT #TODO: DROP
ip46tables -t filter -N local-input
ip46tables -t filter -N local-forward
ip46tables -t nat -N local-prerouting
ip46tables -t nat -N local-postrouting
ip46tables -t filter -I INPUT -j local-input
ip46tables -t filter -I FORWARD -j local-forward
ip46tables -t nat -I PREROUTING -j local-prerouting
ip46tables -t nat -I POSTROUTING -j local-postrouting
ip46tables -t filter -A local-forward -m conntrack --ctstate RELATED,ESTABLISHED,SNAT,DNAT -j ACCEPT
'';
extraStopCommands = mkAfter ''
ip46tables -t filter -D INPUT -j local-input || true
ip46tables -t filter -D FORWARD -j local-forward || true
ip46tables -t nat -D PREROUTING -j local-prerouting || true
ip46tables -t nat -D POSTROUTING -j local-postrouting || true
ip46tables -t filter -F local-input || true
ip46tables -t filter -X local-input || true
ip46tables -t filter -F local-forward || true
ip46tables -t filter -X local-forward || true
ip46tables -t nat -F local-prerouting || true
ip46tables -t nat -X local-prerouting || true
ip46tables -t nat -F local-postrouting || true
ip46tables -t nat -X local-postrouting || true
ip46tables -t filter -P INPUT ACCEPT
ip46tables -t filter -P FORWARD ACCEPT
'';
logRefusedConnections = false;
};
useDHCP = false;
enableIPv6 = mkDefault true;
useNetworkd = mkDefault true;
useHostResolvConf = false;
wireguard.enable = true;
};
systemd.network.networks = mkIf (cfg.dhcpInterface != null) {
"40-${cfg.dhcpInterface}" = {
matchConfig.Name = cfg.dhcpInterface;
networkConfig = {
DHCP = "ipv4";
IPv6AcceptRA = true;
IPv6PrivacyExtensions = "kernel";
};
# make routing on this interface a dependency for network-online.target
linkConfig.RequiredForOnline = "routable";
};
};
};
}
|
