machines/vault01/networking.nix

@@ -116,7 +116,16 @@ let
 
     vlan-admin-ap = {
       Id = 3001;
-      address = [ "fd26:baf9:d250:8010::1/60" ];
+      address = [ "fd26:baf9:d250:8001::1/64" ];
+      extraNetwork.ipv6Prefixes = [
+        {
+          ipv6PrefixConfig = {
+            AddressAutoconfiguration = false;
+            OnLink = false;
+            Prefix = "fd26:baf9:d250:8001::/64";
+          };
+        }
+      ];
     };
 
     vlan-apro = {
@@ -229,12 +238,15 @@ in
         content = ''
           chain postrouting {
             type nat hook postrouting priority 100;
-            snat ip to 129.199.195.130-129.199.195.158
+            ip saddr 10.0.0.0/16 snat ip to 129.199.195.130-129.199.195.158
           }
         '';
       };
     };
-    firewall.allowedUDPPorts = [ 67 ];
+    firewall = {
+      allowedUDPPorts = [ 67 ];
+      checkReversePath = false;
+    };
   };
 
   boot.kernel.sysctl."net.ipv4.ip_forward" = true;

meta/network.nix

@@ -98,17 +98,7 @@
           {
             # see also machines/vault01/networking.nix
             address = "129.199.195.129";
-            prefixLength = 27;
-          }
-        ];
-        gateways = [ ];
-        enableDefaultDNS = true;
-      };
-      enp130s0f0 = {
-        ipv4 = [
-          {
-            address = "192.168.42.7";
-            prefixLength = 24;
+            prefixLength = 32;
           }
         ];
         gateways = [ ];