Compare commits

...

3 commits

Author SHA1 Message Date
411795c664
fix(routing): clean icmp storm
Some checks failed
Check meta / check_meta (pull_request) Successful in 26s
Check meta / check_dns (pull_request) Successful in 48s
build configuration / build_storage01 (pull_request) Successful in 1m30s
build configuration / build_compute01 (pull_request) Successful in 1m37s
build configuration / build_web02 (pull_request) Successful in 1m12s
build configuration / build_rescue01 (pull_request) Successful in 1m8s
build configuration / build_vault01 (pull_request) Successful in 2m3s
build configuration / build_web01 (pull_request) Successful in 2m3s
build configuration / push_to_cache (pull_request) Failing after 3m7s
Check meta / check_meta (push) Successful in 23s
Check meta / check_dns (push) Successful in 42s
build configuration / build_compute01 (push) Successful in 1m23s
build configuration / build_storage01 (push) Successful in 1m23s
build configuration / build_vault01 (push) Successful in 1m11s
build configuration / build_web01 (push) Successful in 1m34s
build configuration / build_web02 (push) Successful in 1m12s
lint / check (push) Successful in 23s
build configuration / build_rescue01 (push) Successful in 1m21s
build configuration / push_to_cache (push) Successful in 3m9s
2024-07-08 20:38:01 +02:00
dce439fcca
fix(shitty-oob): Drop user vlans when no-uplink 2024-07-08 20:38:00 +02:00
37a18c0347
feat(nat): Enable nat (with ip_forward) 2024-07-08 20:38:00 +02:00
2 changed files with 73 additions and 24 deletions

View file

@ -37,16 +37,13 @@ let
}; };
mkUserVlan = mkUserVlan =
id: {
let vlan,
# on alloue 10.0.0.0/17 aux thurnés, avec un /27 chacun, on garde 10.0.0.0/27 pour nous (routeur et autres) netIP,
vlan = 4094 - id; servIP,
prefix24nb = (id + 1) / 8; interfaceName,
prefix27nb = (id + 1 - prefix24nb * 8) * 32; ...
netIP = "10.0.${toString prefix24nb}.${toString prefix27nb}"; }:
servIP = "10.0.${toString prefix24nb}.${toString (prefix27nb + 1)}";
interfaceName = "vlan-user-${toString vlan}";
in
{ {
name = interfaceName; name = interfaceName;
value = { value = {
@ -87,6 +84,15 @@ let
}; };
}; };
userVlans = builtins.genList (id: rec {
vlan = 4094 - id;
prefix24nb = (id + 1) / 8;
prefix27nb = (id + 1 - prefix24nb * 8) * 32;
netIP = "10.0.${toString prefix24nb}.${toString prefix27nb}";
servIP = "10.0.${toString prefix24nb}.${toString (prefix27nb + 1)}";
interfaceName = "vlan-user-${toString vlan}";
}) 850;
vlans = { vlans = {
vlan-uplink-cri = { vlan-uplink-cri = {
Id = 223; Id = 223;
@ -110,7 +116,16 @@ let
vlan-admin-ap = { vlan-admin-ap = {
Id = 3001; Id = 3001;
address = [ "fd26:baf9:d250:8010::1/60" ]; address = [ "fd26:baf9:d250:8001::1/64" ];
extraNetwork.ipv6Prefixes = [
{
ipv6PrefixConfig = {
AddressAutoconfiguration = false;
OnLink = false;
Prefix = "fd26:baf9:d250:8001::/64";
};
}
];
}; };
vlan-apro = { vlan-apro = {
@ -119,7 +134,7 @@ let
extraNetwork.networkConfig.DHCPServer = "yes"; extraNetwork.networkConfig.DHCPServer = "yes";
}; };
} // builtins.listToAttrs (builtins.genList mkUserVlan 850); } // builtins.listToAttrs (map mkUserVlan userVlans);
in in
{ {
@ -187,8 +202,52 @@ in
}; };
systemd-networkd.serviceConfig.LimitNOFILE = 4096; systemd-networkd.serviceConfig.LimitNOFILE = 4096;
net-checker = {
path = [
pkgs.iputils
pkgs.systemd
];
script = ''
if ping -c 1 8.8.8.8 > /dev/null || ping -c 1 1.1.1.1 > /dev/null; then
${
lib.concatMapStringsSep "\n " ({ interfaceName, ... }: "networkctl up ${interfaceName}") userVlans
}
else
${
lib.concatMapStringsSep "\n " (
{ interfaceName, ... }: "networkctl down ${interfaceName}"
) userVlans
}
fi
'';
};
};
timers.net-checker = {
wantedBy = [ "timers.target" ];
timerConfig.OnCalendar = "*-*-* *:*:42";
}; };
}; };
networking.firewall.allowedUDPPorts = [ 67 ]; networking = {
nftables = {
enable = true;
tables.nat = {
family = "ip";
content = ''
chain postrouting {
type nat hook postrouting priority 100;
ip saddr 10.0.0.0/16 snat ip to 129.199.195.130-129.199.195.158
}
'';
};
};
firewall = {
allowedUDPPorts = [ 67 ];
checkReversePath = false;
};
};
boot.kernel.sysctl."net.ipv4.ip_forward" = true;
} }

View file

@ -98,17 +98,7 @@
{ {
# see also machines/vault01/networking.nix # see also machines/vault01/networking.nix
address = "129.199.195.129"; address = "129.199.195.129";
prefixLength = 27; prefixLength = 32;
}
];
gateways = [ ];
enableDefaultDNS = true;
};
enp130s0f0 = {
ipv4 = [
{
address = "192.168.42.7";
prefixLength = 24;
} }
]; ];
gateways = [ ]; gateways = [ ];