2024-10-18 11:05:12 +02:00
|
|
|
{
|
|
|
|
systemd.network = {
|
2024-10-18 13:35:15 +02:00
|
|
|
config.routeTables = {
|
|
|
|
he = 100;
|
2024-10-29 06:59:21 +01:00
|
|
|
mwan = 110;
|
2024-10-18 13:35:15 +02:00
|
|
|
};
|
2024-10-18 11:05:12 +02:00
|
|
|
networks = {
|
|
|
|
"10-ens18" = {
|
|
|
|
name = "ens18";
|
|
|
|
|
|
|
|
networkConfig = {
|
|
|
|
Description = "ENS uplink";
|
2024-12-21 12:56:46 +01:00
|
|
|
Address = [
|
|
|
|
"129.199.146.231/24"
|
|
|
|
"129.199.146.230/24"
|
|
|
|
];
|
2024-10-18 11:05:12 +02:00
|
|
|
Gateway = "129.199.146.254";
|
|
|
|
LLDP = true;
|
|
|
|
# Only to the switch we are connected to directly, e.g. the hypervisor or the switch.
|
|
|
|
EmitLLDP = "nearest-bridge";
|
2024-10-18 13:35:15 +02:00
|
|
|
Tunnel = [
|
|
|
|
"gre-mwan"
|
|
|
|
"sit-he"
|
|
|
|
];
|
|
|
|
};
|
|
|
|
};
|
|
|
|
"10-ens19" = {
|
|
|
|
name = "ens19";
|
|
|
|
networkConfig = {
|
|
|
|
Description = "Lan bridge";
|
|
|
|
};
|
|
|
|
vlan = [
|
2024-10-29 06:59:21 +01:00
|
|
|
"vlan-mwan-siit"
|
|
|
|
"vlan-he-dmz"
|
2024-10-18 13:35:15 +02:00
|
|
|
];
|
|
|
|
};
|
|
|
|
"50-tun-he" = {
|
|
|
|
name = "sit-he";
|
|
|
|
networkConfig = {
|
2024-12-21 12:56:46 +01:00
|
|
|
Description = "HE.NET IPv6 Tunnel (maurice)";
|
|
|
|
Address = [ "2001:470:1f12:2b::2/64" ];
|
2024-10-18 13:35:15 +02:00
|
|
|
ConfigureWithoutCarrier = true;
|
|
|
|
};
|
|
|
|
routes = [
|
|
|
|
{
|
2024-11-19 12:38:14 +01:00
|
|
|
Destination = "::/0";
|
|
|
|
Table = "he";
|
|
|
|
Scope = "global";
|
2024-10-18 13:35:15 +02:00
|
|
|
}
|
|
|
|
{
|
|
|
|
# Use HE tunnel for router trafic as well
|
2024-11-19 12:38:14 +01:00
|
|
|
Destination = "::/0";
|
|
|
|
Scope = "global";
|
2024-10-18 13:35:15 +02:00
|
|
|
}
|
|
|
|
];
|
|
|
|
routingPolicyRules = [
|
|
|
|
{
|
|
|
|
routingPolicyRuleConfig = {
|
2024-12-21 12:56:46 +01:00
|
|
|
From = "2001:470:1f13:2b::/64";
|
2024-10-18 13:35:15 +02:00
|
|
|
Table = "he";
|
|
|
|
};
|
|
|
|
}
|
2024-10-29 06:59:21 +01:00
|
|
|
{
|
|
|
|
routingPolicyRuleConfig = {
|
2024-12-21 12:56:46 +01:00
|
|
|
To = "2001:470:1f13:2b::/64";
|
2024-10-29 06:59:21 +01:00
|
|
|
Table = "he";
|
|
|
|
};
|
|
|
|
}
|
2024-10-18 13:35:15 +02:00
|
|
|
];
|
|
|
|
};
|
|
|
|
"50-tun-mwan" = {
|
|
|
|
name = "gre-mwan";
|
|
|
|
networkConfig = {
|
|
|
|
Description = "Tunnel de livraison GRE IPv4/IPv6 de MilkyWAN";
|
|
|
|
Address = [
|
|
|
|
"10.1.1.50/30"
|
|
|
|
"2a0b:cbc0:1::216/126"
|
2024-10-29 06:59:21 +01:00
|
|
|
"2a0e:e701:1120::1/64"
|
2024-10-18 13:35:15 +02:00
|
|
|
];
|
|
|
|
ConfigureWithoutCarrier = true;
|
2024-10-18 11:05:12 +02:00
|
|
|
};
|
2024-10-29 06:59:21 +01:00
|
|
|
routes = [
|
|
|
|
{
|
2024-11-19 12:38:14 +01:00
|
|
|
Gateway = "2a0b:cbc0:1::215";
|
|
|
|
PreferredSource = "2a0e:e701:1120::1";
|
2024-10-29 06:59:21 +01:00
|
|
|
}
|
|
|
|
{
|
|
|
|
# Local route
|
2024-11-19 12:38:14 +01:00
|
|
|
Table = "mwan";
|
|
|
|
Destination = "2a0e:e701:1120::/64";
|
2024-10-29 06:59:21 +01:00
|
|
|
}
|
|
|
|
{
|
|
|
|
# Default unreachable route for unattributed prefixes of our /48
|
2024-11-19 12:38:14 +01:00
|
|
|
Table = "mwan";
|
|
|
|
Metric = 9999;
|
|
|
|
Destination = "2a0e:e701:1120::/48";
|
|
|
|
Type = "unreachable";
|
2024-10-29 06:59:21 +01:00
|
|
|
}
|
|
|
|
{
|
2024-11-19 12:38:14 +01:00
|
|
|
Table = "mwan";
|
|
|
|
Gateway = "2a0b:cbc0:1::215";
|
|
|
|
PreferredSource = "2a0e:e701:1120::1";
|
2024-10-29 06:59:21 +01:00
|
|
|
}
|
|
|
|
# IPv4
|
|
|
|
{
|
2024-11-19 12:38:14 +01:00
|
|
|
Scope = "global";
|
|
|
|
Table = "mwan";
|
|
|
|
Gateway = "10.1.1.49";
|
2024-10-29 06:59:21 +01:00
|
|
|
}
|
|
|
|
];
|
|
|
|
routingPolicyRules = [
|
|
|
|
{
|
|
|
|
routingPolicyRuleConfig = {
|
|
|
|
From = "45.13.104.24/29";
|
|
|
|
Table = "mwan";
|
|
|
|
};
|
|
|
|
}
|
|
|
|
{
|
|
|
|
routingPolicyRuleConfig = {
|
|
|
|
To = "45.13.104.24/29";
|
|
|
|
Table = "mwan";
|
|
|
|
};
|
|
|
|
}
|
|
|
|
{
|
|
|
|
routingPolicyRuleConfig = {
|
|
|
|
From = "2a0e:e701:1120::/48";
|
|
|
|
Table = "mwan";
|
|
|
|
};
|
|
|
|
}
|
|
|
|
{
|
|
|
|
routingPolicyRuleConfig = {
|
|
|
|
To = "2a0e:e701:1120::/48";
|
|
|
|
Table = "mwan";
|
|
|
|
};
|
|
|
|
}
|
|
|
|
];
|
2024-10-18 11:05:12 +02:00
|
|
|
};
|
2024-10-29 06:59:21 +01:00
|
|
|
"60-vlan-mwan-siit" = {
|
|
|
|
name = "vlan-mwan-siit";
|
2024-10-18 13:35:15 +02:00
|
|
|
networkConfig = {
|
2024-10-29 06:59:21 +01:00
|
|
|
Description = "SIIT-DC vers MilkyWAN";
|
|
|
|
Address = [ "2a0e:e701:1120:1000::1/64" ];
|
|
|
|
IPv6SendRA = "yes";
|
2024-10-18 13:35:15 +02:00
|
|
|
};
|
2024-10-29 06:59:21 +01:00
|
|
|
ipv6SendRAConfig = {
|
|
|
|
DNS = [ "2a0e:e701:1120:1000::f:1" ];
|
2024-10-18 13:35:15 +02:00
|
|
|
};
|
2024-10-29 06:59:21 +01:00
|
|
|
ipv6Prefixes = [
|
|
|
|
{
|
|
|
|
ipv6PrefixConfig = {
|
|
|
|
Prefix = "2a0e:e701:1120:1000::/64";
|
|
|
|
};
|
|
|
|
}
|
|
|
|
];
|
|
|
|
routes = [
|
|
|
|
{
|
2024-11-19 12:38:14 +01:00
|
|
|
Table = "mwan";
|
|
|
|
Destination = "2a0e:e701:1120:1000::/64";
|
2024-10-29 06:59:21 +01:00
|
|
|
}
|
|
|
|
];
|
2024-10-18 13:35:15 +02:00
|
|
|
};
|
2024-10-29 06:59:21 +01:00
|
|
|
"60-vlan-he-dmz" = {
|
|
|
|
name = "vlan-he-dmz";
|
2024-10-18 13:35:15 +02:00
|
|
|
networkConfig = {
|
|
|
|
Description = "HE DMZ VLAN";
|
2024-12-21 12:56:46 +01:00
|
|
|
Address = [ "2001:470:1f13:2b::1/64" ];
|
2024-10-18 13:35:15 +02:00
|
|
|
IPv6SendRA = "yes";
|
|
|
|
};
|
|
|
|
ipv6Prefixes = [
|
|
|
|
{
|
|
|
|
ipv6PrefixConfig = {
|
2024-12-21 12:56:46 +01:00
|
|
|
Prefix = "2001:470:1f13:2b::0/64";
|
2024-10-18 13:35:15 +02:00
|
|
|
};
|
|
|
|
}
|
|
|
|
];
|
|
|
|
routes = [
|
|
|
|
{
|
2024-11-19 12:38:14 +01:00
|
|
|
Table = "he";
|
|
|
|
Scope = "global";
|
2024-12-21 12:56:46 +01:00
|
|
|
Destination = "2001:470:1f13:2b::/64";
|
2024-10-18 13:35:15 +02:00
|
|
|
}
|
|
|
|
];
|
|
|
|
};
|
|
|
|
};
|
|
|
|
netdevs = {
|
|
|
|
"50-tun-he" = {
|
|
|
|
netdevConfig = {
|
|
|
|
Kind = "sit";
|
|
|
|
Name = "sit-he";
|
|
|
|
};
|
|
|
|
tunnelConfig = {
|
2024-12-21 12:56:46 +01:00
|
|
|
Local = "129.199.146.231";
|
2024-10-18 13:35:15 +02:00
|
|
|
Remote = "216.66.84.42";
|
|
|
|
};
|
|
|
|
};
|
|
|
|
"50-tun-mwan" = {
|
|
|
|
netdevConfig = {
|
|
|
|
Kind = "gre";
|
|
|
|
Name = "gre-mwan";
|
|
|
|
MTUBytes = "1480";
|
|
|
|
};
|
|
|
|
tunnelConfig = {
|
|
|
|
Local = "129.199.146.230";
|
|
|
|
Remote = "80.67.167.30";
|
|
|
|
};
|
|
|
|
};
|
2024-10-29 06:59:21 +01:00
|
|
|
"60-vlan-mwan-siit" = {
|
2024-10-18 13:35:15 +02:00
|
|
|
netdevConfig = {
|
|
|
|
Kind = "vlan";
|
2024-10-29 06:59:21 +01:00
|
|
|
Name = "vlan-mwan-siit";
|
2024-10-18 13:35:15 +02:00
|
|
|
};
|
2024-10-29 06:59:21 +01:00
|
|
|
vlanConfig.Id = 2520;
|
2024-10-18 13:35:15 +02:00
|
|
|
};
|
2024-10-29 06:59:21 +01:00
|
|
|
"60-vlan-he-dmz" = {
|
2024-10-18 13:35:15 +02:00
|
|
|
netdevConfig = {
|
|
|
|
Kind = "vlan";
|
2024-10-29 06:59:21 +01:00
|
|
|
Name = "vlan-he-dmz";
|
2024-10-18 13:35:15 +02:00
|
|
|
};
|
|
|
|
vlanConfig.Id = 2530;
|
|
|
|
};
|
2024-10-18 11:05:12 +02:00
|
|
|
};
|
|
|
|
};
|
2024-10-18 13:35:15 +02:00
|
|
|
networking = {
|
|
|
|
firewall = {
|
2024-10-29 06:59:21 +01:00
|
|
|
allowedUDPPorts = [
|
|
|
|
67
|
|
|
|
53
|
|
|
|
];
|
2024-10-18 13:35:15 +02:00
|
|
|
extraInputRules = ''
|
|
|
|
ip protocol gre ip saddr 80.67.167.30 accept;
|
2024-10-29 06:59:21 +01:00
|
|
|
'';
|
|
|
|
logReversePathDrops = true;
|
|
|
|
checkReversePath = "loose";
|
|
|
|
};
|
|
|
|
};
|
|
|
|
networking.jool = {
|
|
|
|
enable = true;
|
|
|
|
siit.siitdefault = {
|
|
|
|
global = {
|
|
|
|
manually-enabled = true;
|
|
|
|
pool6 = "2a0e:e701:1120:ffff::/96";
|
|
|
|
rfc6791v4-prefix = "10.243.0.0/24";
|
|
|
|
randomize-rfc6791-addresses = false;
|
|
|
|
lowest-ipv6-mtu = 1500;
|
|
|
|
logging-debug = true;
|
|
|
|
};
|
|
|
|
eamt = [
|
|
|
|
{
|
|
|
|
"ipv4 prefix" = "45.13.104.24/29";
|
|
|
|
"ipv6 prefix" = "2a0e:e701:1120:1000:ffff::45.13.104.24/125";
|
|
|
|
}
|
|
|
|
];
|
|
|
|
denylist4 = [
|
|
|
|
"129.199.146.230/32" # ENS
|
|
|
|
];
|
2024-10-18 13:35:15 +02:00
|
|
|
};
|
|
|
|
};
|
|
|
|
|
|
|
|
boot.kernel.sysctl = {
|
|
|
|
"net.ipv4.ip_forward" = true;
|
|
|
|
"net.ipv6.conf.all.forwarding" = true;
|
|
|
|
};
|
2024-10-18 11:05:12 +02:00
|
|
|
}
|