335 lines
10 KiB
Nix
335 lines
10 KiB
Nix
{ config, pkgs, lib, ... }:
|
|
let
|
|
inherit (lib) mkOption types;
|
|
mkVLAN = name: id: {
|
|
netdevConfig = {
|
|
Kind = "vlan";
|
|
Name = name;
|
|
};
|
|
vlanConfig.Id = id;
|
|
};
|
|
mkTunnel = kind: name: { local, remote, mtu ? 1480 }: {
|
|
netdevConfig = {
|
|
Kind = kind;
|
|
Name = name;
|
|
MTUBytes = toString mtu;
|
|
};
|
|
tunnelConfig = {
|
|
Local = local;
|
|
Remote = remote;
|
|
};
|
|
};
|
|
vip = config.router.wan.vip;
|
|
rip = config.router.wan.rip;
|
|
in
|
|
{
|
|
options.router = {
|
|
wan = {
|
|
vip = mkOption {
|
|
type = types.str;
|
|
description = "Highly-available virtual IP address of the router";
|
|
};
|
|
rip = mkOption {
|
|
type = types.str;
|
|
description = "Real IP address of the router";
|
|
};
|
|
};
|
|
};
|
|
config = {
|
|
router.wan.vip = "129.199.146.230";
|
|
router.wan.rip = "129.199.146.231";
|
|
networking.firewall.allowedUDPPorts = [ 25351 ];
|
|
systemd.network.enable = true;
|
|
networking.dhcpcd.enable = false;
|
|
systemd.network.links."10-swp" = {
|
|
matchConfig.MACAddress = "92:E3:9C:CE:EF:14";
|
|
linkConfig.Name = "swp";
|
|
};
|
|
systemd.network = {
|
|
config.routeTables = {
|
|
he = 100;
|
|
mwan = 110;
|
|
};
|
|
netdevs = {
|
|
"05-admin-vpn" = {
|
|
netdevConfig = {
|
|
Kind = "wireguard";
|
|
Name = "wgadmin";
|
|
MTUBytes = "1420";
|
|
};
|
|
wireguardConfig = {
|
|
PrivateKeyFile = "/etc/secrets/wireguard/wgadmin";
|
|
ListenPort = 25351;
|
|
};
|
|
wireguardPeers = [
|
|
{
|
|
wireguardPeerConfig = {
|
|
PublicKey = "obsUPq4Y1XGbl3yPUytPKkVcSP+eECpaQX+bV+ocwXg=";
|
|
AllowedIPs = [ "fd81:fb3a:50cc::100/128" ];
|
|
};
|
|
}
|
|
];
|
|
};
|
|
"10-tun-mwan" = mkTunnel "gre" "gre-mwan" {
|
|
remote = "80.67.167.30";
|
|
local = vip;
|
|
};
|
|
"10-tun-he" = mkTunnel "sit" "sit-he" {
|
|
remote = "216.66.84.42";
|
|
local = vip;
|
|
};
|
|
# VLANs
|
|
# 401: uplink ENS
|
|
# 3500: intranet club réseau, proxy ARP et proxy arp pvlan / 10.1.1.1/22
|
|
# 3510: mgmt club réseau (administration network) / fd81:fb3a:50cc::/64
|
|
# 3605: MWAN V6 DMZ / 2a0e:e701:1120:b00c::1/64
|
|
# 3606: MWAN V4 DMZ / 45.13.104.25/29
|
|
# 3607: Club Réseau v6 DMZ (en ASN propre)
|
|
# 3608: DN42 DMZ
|
|
# 3609: HE V6 DMZ / 2001:470:1f13:187::1/64
|
|
# 3610: Free V6 DMZ
|
|
# 3620: HE.net IPv6 /48 -> DHCP-PD /60
|
|
# 3621: MWAN DMZ /48 PD delivery / 2a0e:e701:1120::1/48
|
|
# 3622: Router VRRP link / $to_be_determined.
|
|
# "10-uplink-ens" = mkVLAN "uplink-ens" 401; dysfunctional?
|
|
"10-intranet-krz" = mkVLAN "intranet-krz" 3500;
|
|
"10-admin" = mkVLAN "admin" 3510;
|
|
"10-mwan-v6" = mkVLAN "mwan-v6" 3605;
|
|
"10-mwan-dual" = mkVLAN "mwan-dual" 3606;
|
|
"10-krz-v6" = mkVLAN "krz-v6" 3607;
|
|
"10-dn42-dmz" = mkVLAN "dn42-dmz" 3608;
|
|
"10-he-dmz" = mkVLAN "he-dmz" 3609;
|
|
"10-free-dmz" = mkVLAN "free-dmz" 3610;
|
|
"10-he-pd" = mkVLAN "he-v6-pd" 3620;
|
|
"10-mwan-pd" = mkVLAN "mwan-v6-pd" 3621;
|
|
"10-vrrp-router" = mkVLAN "vrrp-router" 3622;
|
|
};
|
|
networks = {
|
|
"10-admin-vpn" = {
|
|
matchConfig.Name = "wgadmin";
|
|
networkConfig = {
|
|
Description = "VPN d'administration système de l'infrastructure";
|
|
Address = [ "fd81:fb3a:50cc::1/64" ];
|
|
# Give access to the rest of the network.
|
|
IPForward = "ipv6";
|
|
ConfigureWithoutCarrier = true;
|
|
};
|
|
linkConfig.RequiredForOnline = "routable";
|
|
};
|
|
"15-admin-vlan" = {
|
|
matchConfig.Name = "admin";
|
|
networkConfig = {
|
|
Description = "VLAN d'administration système de l'infrastructure";
|
|
Address = [ "fd81:fb3a:50cc:1::1/48" ];
|
|
# Give access to the rest of the network.
|
|
IPForward = "ipv6";
|
|
IPv6ProxyNDP = true;
|
|
ConfigureWithoutCarrier = true;
|
|
};
|
|
linkConfig.RequiredForOnline = "routable";
|
|
};
|
|
"20-tun-mwan" = {
|
|
matchConfig.Name = "gre-mwan";
|
|
networkConfig = {
|
|
Description = "Tunnel de livraison GRE IPv4/IPv6 de MilkyWAN";
|
|
Address = [ "10.1.1.50/30" "2a0b:cbc0:1::216/126" ];
|
|
ConfigureWithoutCarrier = true;
|
|
};
|
|
routes = [
|
|
{
|
|
routeConfig = {
|
|
Gateway = "10.1.1.49";
|
|
Table = "mwan";
|
|
Scope = "global";
|
|
# FIXME(raito): Has no effect? Upstream bug?
|
|
Source = "45.13.104.25/29";
|
|
};
|
|
}
|
|
{
|
|
routeConfig = {
|
|
Destination = "::/0";
|
|
Gateway = "2a0b:cbc0:1::215";
|
|
Table = "mwan";
|
|
Scope = "global";
|
|
Source = "2a0e:e701:1120::/48";
|
|
};
|
|
}
|
|
];
|
|
routingPolicyRules = [
|
|
{
|
|
routingPolicyRuleConfig = {
|
|
From = "2a0e:e701:1120::/48";
|
|
Table = "mwan";
|
|
};
|
|
}
|
|
{
|
|
routingPolicyRuleConfig = {
|
|
From = "45.13.104.25/29";
|
|
Table = "mwan";
|
|
};
|
|
}
|
|
];
|
|
};
|
|
"20-tun-he" = {
|
|
matchConfig.Name = "sit-he";
|
|
networkConfig = {
|
|
Description = "HE.NET IPv6 Tunnel (owned by gdd)";
|
|
Address = [ "2001:470:1f12:187::2/64" ];
|
|
ConfigureWithoutCarrier = true;
|
|
};
|
|
routes = [
|
|
{
|
|
routeConfig = {
|
|
Destination = "::/0";
|
|
Table = "he";
|
|
Scope = "global";
|
|
Source = "2001:470:1f13::/48";
|
|
};
|
|
}
|
|
];
|
|
routingPolicyRules = [
|
|
{
|
|
routingPolicyRuleConfig = {
|
|
From = "2001:470:1f13::/48";
|
|
Table = "he";
|
|
};
|
|
}
|
|
];
|
|
};
|
|
"10-swp" = {
|
|
matchConfig.Name = "swp";
|
|
networkConfig = {
|
|
Description = "VLAN-aware switch port";
|
|
Address = [ "${rip}/24" ];
|
|
Gateway = "129.199.146.254";
|
|
LLDP = true;
|
|
# Only to the switch we are connected to directly, e.g. the hypervisor or the switch.
|
|
EmitLLDP = "nearest-bridge";
|
|
# For VRRP.
|
|
KeepConfiguration = true;
|
|
};
|
|
routingPolicyRules = [
|
|
{
|
|
routingPolicyRuleConfig = {
|
|
From = "45.13.104.25/29";
|
|
Type = "prohibit";
|
|
};
|
|
}
|
|
];
|
|
tunnel = [
|
|
"gre-mwan"
|
|
"sit-he"
|
|
];
|
|
vlan = [
|
|
# "intranet-krz" - we don't want to keep this.
|
|
"admin"
|
|
# FIXME: "mwan-v6" - do we want to keep this?
|
|
# We can achieve v6-only by enforcing MAC address isolation for IPv4.
|
|
"mwan-dual"
|
|
# FIXME: legacy-nat-zone.
|
|
# FIXME: "krz-v6" - not ready yet.
|
|
# FIXME: "dn42-dmz" - revive this if you want.
|
|
"he-dmz"
|
|
# FIXME: "free-dmz" - not ready yet, abandoned?
|
|
# FIXME: "he-v6-pd" - require rework
|
|
# FIXME: "mwan-v6-pd" - require rework
|
|
];
|
|
};
|
|
# TODO: SIIT/NAT64/DNS64 component to avoid IPv4 dependency.
|
|
"20-mwan-dual" = {
|
|
matchConfig.Name = "mwan-dual";
|
|
addresses = [
|
|
{
|
|
addressConfig = {
|
|
Address = "2a0e:e701:1120:b00c::1/64";
|
|
AddPrefixRoute = false;
|
|
};
|
|
}
|
|
{
|
|
addressConfig = {
|
|
Address = "45.13.104.25/29";
|
|
AddPrefixRoute = false;
|
|
};
|
|
}
|
|
];
|
|
routes = [
|
|
{
|
|
routeConfig = {
|
|
Destination = "2a0e:e701:1120:b00c::/64";
|
|
Metric = 256;
|
|
Table = "mwan";
|
|
};
|
|
}
|
|
{
|
|
routeConfig = {
|
|
Destination = "45.13.104.25/29";
|
|
Metric = 256;
|
|
Table = "mwan";
|
|
};
|
|
}
|
|
];
|
|
networkConfig = {
|
|
Description = "MilkyWAN dual stack public interface";
|
|
DHCPServer = true;
|
|
IPv6SendRA = true;
|
|
IPForward = true;
|
|
ConfigureWithoutCarrier = true;
|
|
};
|
|
};
|
|
"20-he-dmz" = {
|
|
matchConfig.Name = "he-dmz";
|
|
addresses = [
|
|
{
|
|
addressConfig = {
|
|
Address = "2001:470:1f13:187::1/64";
|
|
# This will add it in the wrong table.
|
|
# TODO: add to systemd a `Table` option here.
|
|
AddPrefixRoute = false;
|
|
};
|
|
}
|
|
];
|
|
routes = [
|
|
{
|
|
routeConfig = {
|
|
Destination = "2001:470:1f13:187::/64";
|
|
Metric = 256;
|
|
Table = "he";
|
|
};
|
|
}
|
|
];
|
|
networkConfig = {
|
|
Description = "Hurricane Electrical's 187 /64 unfirewalled zone";
|
|
IPv6SendRA = true;
|
|
ConfigureWithoutCarrier = true;
|
|
};
|
|
};
|
|
};
|
|
};
|
|
|
|
# services.keepalived.enable = true;
|
|
# services.keepalived.vrrpInstances.wan = {
|
|
# interface = "swp";
|
|
# state = "MASTER";
|
|
# priority = 50;
|
|
# virtualIps = [{ addr = "129.199.146.230"; }];
|
|
# virtualRouterId = 1;
|
|
# };
|
|
|
|
|
|
# systemd.services."systemd-networkd".environment.SYSTEMD_LOG_LEVEL = "debug";
|
|
environment.systemPackages = [ pkgs.tcpdump pkgs.wireguard-tools ];
|
|
|
|
# Zone based firewall
|
|
|
|
# Flow accounting in PostgreSQL.
|
|
services.postgresql = {
|
|
enable = true;
|
|
ensureUsers = [];
|
|
};
|
|
# services.ulogd = {
|
|
# enable = true;
|
|
# settings = {
|
|
# };
|
|
# };
|
|
};
|
|
}
|