DGNum/lab-infra
8
1
Fork 1
Code Issues 1 Pull requests 1 Projects Releases Packages Wiki Activity Actions

feat(router02): mwan transit, nat64, siit

Browse source 
feat(router02): mwan transit, nat64, dns64
This commit is contained in:
sinavir 2024-10-29 06:59:21 +01:00
parent c2a3c53cde
commit 27856d2b44
1 changed files with 186 additions and 23 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

209
machines/router02/networking.nix
View file

@ -2,6 +2,7 @@
systemd.network = {
config.routeTables = {
he = 100;
mwan = 110;
};
networks = {
"10-ens18" = {
@ -26,8 +27,10 @@
Description = "Lan bridge";
};
vlan = [
"vlan-nat"
"vlan-he"
"vlan-ens-nat"
"vlan-mwan-nat64"
"vlan-mwan-siit"
"vlan-he-dmz"
];
};
"50-tun-he" = {
@ -60,6 +63,12 @@
Table = "he";
};
}
{
routingPolicyRuleConfig = {
To = "2001:470:1f13:187::/64";
Table = "he";
};
}
];
};
"50-tun-mwan" = {
@ -68,14 +77,70 @@
Description = "Tunnel de livraison GRE IPv4/IPv6 de MilkyWAN";
Address = [
"10.1.1.50/30"
"45.13.104.25/29"
"2a0b:cbc0:1::216/126"
"2a0e:e701:1120::1/64"
];
ConfigureWithoutCarrier = true;
};
routes = [
{
routeConfig = {
Gateway = "2a0b:cbc0:1::215";
PreferredSource = "2a0e:e701:1120::1";
};
}
{
# Local route
routeConfig = {
Table = "mwan";
Destination = "2a0e:e701:1120::/64";
};
}
{
# Default unreachable route for unattributed prefixes of our /48
routeConfig = {
Table = "mwan";
Metric = 9999;
Destination = "2a0e:e701:1120::/48";
Type = "unreachable";
};
}
{
routeConfig = {
Table = "mwan";
Gateway = "2a0b:cbc0:1::215";
PreferredSource = "2a0e:e701:1120::1";
};
}
# IPv4
{
routeConfig = {
Scope = "global";
Gateway = "10.1.1.49";
PreferredSource = "45.13.104.25";
};
}
];
routingPolicyRules = [
{
routingPolicyRuleConfig = {
From = "2a0e:e701:1120::/48";
Table = "mwan";
};
}
{
routingPolicyRuleConfig = {
To = "2a0e:e701:1120::/48";
Table = "mwan";
};
}
];
};
"60-vlan-nat" = {
name = "vlan-nat";
"60-vlan-ens-nat" = {
name = "vlan-ens-nat";
networkConfig = {
# TODO NAT64 ENS => need netns
Description = "Nat IPv4 vers renater";
Address = [ "10.3.161.1/24" ];
DHCPServer = true;
@ -84,8 +149,60 @@
PoolOffset = 50;
};
};
"60-vlan-he" = {
name = "vlan-he";
"60-vlan-mwan-siit" = {
name = "vlan-mwan-siit";
networkConfig = {
Description = "SIIT-DC vers MilkyWAN";
Address = [ "2a0e:e701:1120:1000::1/64" ];
IPv6SendRA = "yes";
};
ipv6SendRAConfig = {
DNS = [ "2a0e:e701:1120:1000::f:1" ];
};
ipv6Prefixes = [
{
ipv6PrefixConfig = {
Prefix = "2a0e:e701:1120:1000::/64";
};
}
];
routes = [
{
routeConfig = {
Table = "mwan";
Destination = "2a0e:e701:1120:1000::/64";
};
}
];
};
"60-vlan-mwan-nat64" = {
name = "vlan-mwan-nat64";
networkConfig = {
Description = "Nat IPv4 vers MilkyWAN";
Address = [ "2a0e:e701:1120:64::/64" ];
IPv6SendRA = "yes";
};
ipv6SendRAConfig = {
DNS = [ "2a0e:e701:1120:1000::f:1" ];
};
ipv6Prefixes = [
{
ipv6PrefixConfig = {
Prefix = "2a0e:e701:1120:64::/64";
};
}
];
routes = [
{
routeConfig = {
Table = "mwan";
Destination = "2a0e:e701:1120:64::/64";
};
}
];
};
"60-vlan-he-dmz" = {
name = "vlan-he-dmz";
networkConfig = {
Description = "HE DMZ VLAN";
Address = [ "2001:470:1f13:187::1/64" ];
@ -107,17 +224,7 @@
};
}
];
routingPolicyRules = [
{
routingPolicyRuleConfig = {
To = "2001:470:1f13:187::/64";
Table = "he";
};
}
];
};
};
netdevs = {
"50-tun-he" = {
@ -141,17 +248,31 @@
Remote = "80.67.167.30";
};
};
"60-vlan-nat" = {
"60-vlan-ens-nat" = {
netdevConfig = {
Kind = "vlan";
Name = "vlan-nat";
Name = "vlan-ens-nat";
};
vlanConfig.Id = 2510;
};
"60-vlan-he" = {
"60-vlan-mwan-nat64" = {
netdevConfig = {
Kind = "vlan";
Name = "vlan-he";
Name = "vlan-mwan-nat64";
};
vlanConfig.Id = 2521;
};
"60-vlan-mwan-siit" = {
netdevConfig = {
Kind = "vlan";
Name = "vlan-mwan-siit";
};
vlanConfig.Id = 2520;
};
"60-vlan-he-dmz" = {
netdevConfig = {
Kind = "vlan";
Name = "vlan-he-dmz";
};
vlanConfig.Id = 2530;
};
@ -171,10 +292,53 @@
};
};
firewall = {
allowedUDPPorts = [ 67 ];
allowedUDPPorts = [
67
53
];
extraInputRules = ''
ip protocol gre ip saddr 80.67.167.30 accept;
'';
'';
logReversePathDrops = true;
checkReversePath = "loose";
};
};
networking.jool = {
enable = true;
nat64.default = {
global = {
pool6 = "64:ff9b::/96";
lowest-ipv6-mtu = 1500;
logging-bib = true;
logging-session = true;
};
pool4 =
builtins.map
(protocol: {
prefix = "45.13.104.25/32";
inherit protocol;
})
[
"TCP"
"UDP"
"ICMP"
];
};
siit.default = {
global = {
pool6 = "2a0b:e701:1120:ffff::/96";
rfc6791v4-prefix = "45.13.104.25/32";
lowest-ipv6-mtu = 1500;
};
eamt = [
{
"ipv4 prefix" = "45.13.104.24/29";
"ipv6 prefix" = "2a0b:e701:1120:1000:ffff::45.13.104.24/125";
}
];
denylist4 = [
"129.199.146.0/24" # ENS
];
};
};
@ -182,5 +346,4 @@
"net.ipv4.ip_forward" = true;
"net.ipv6.conf.all.forwarding" = true;
};
}