nilsandClaude Sonnet 5.5
0653b5cf2f
- Allow the WAN link to also carry LANs when the uplink is PPPoE on a VLAN with IPv6 off; only the PPP device counts as an uplink then, so LAN traffic can never match WAN rules. - Add router.rollback: router-arm / router-confirm / router-rollback plus `nix run .#deploy`, a commit-confirm deployment flow. - Wait for the LAN devices instead of the uplink in networkd wait-online, so an unplugged uplink cannot block boot or activation. - Add examples/desktop (single NIC, PPPoE on VLAN 1001) as nixosConfigurations.example, built as a flake check. Covered by the onestick and rollback VM tests and new assertion cases. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
285 lines
10 KiB
Nix
285 lines
10 KiB
Nix
{ config, lib, ... }:
|
|
let
|
|
cfg = config.router;
|
|
lans = lib.attrValues cfg.lans;
|
|
|
|
set = ifaces: "{ ${lib.concatMapStringsSep ", " (i: ''"${i}"'') ifaces} }";
|
|
wgs = lib.attrValues cfg.wireguard;
|
|
isV6 = lib.hasInfix ":";
|
|
|
|
# Everything that is a firewall zone member: LANs and tunnels.
|
|
members =
|
|
map (l: {
|
|
inherit (l)
|
|
device
|
|
zone
|
|
internet
|
|
allowManagement
|
|
;
|
|
}) lans
|
|
++ map (w: {
|
|
device = w.interface;
|
|
inherit (w) zone internet allowManagement;
|
|
}) wgs;
|
|
devicesOf = pred: map (m: m.device) (lib.filter pred members);
|
|
|
|
lanIfaces = map (l: l.device) lans;
|
|
memberIfaces = devicesOf (_: true);
|
|
dnsIfaces = lanIfaces ++ map (w: w.interface) (lib.filter (w: w.dns) wgs);
|
|
mgmtIfaces = devicesOf (m: m.allowManagement);
|
|
internetIfaces = devicesOf (m: m.internet);
|
|
listenPorts = lib.unique (map (w: w.listenPort) (lib.filter (w: w.listenPort != null) wgs));
|
|
masqueradeIfaces = map (w: w.interface) (lib.filter (w: w.masquerade) wgs);
|
|
|
|
# Destinations a kill-switched tunnel must never leak to an uplink.
|
|
killSwitched = lib.filter (w: w.killSwitch) wgs;
|
|
killNets = lib.concatMap (w: lib.concatMap (p: p.allowedIPs) (lib.attrValues w.peers)) killSwitched;
|
|
killRules =
|
|
let
|
|
v4 = lib.filter (n: !isV6 n) killNets;
|
|
v6 = lib.filter isV6 killNets;
|
|
list = ns: "{ ${lib.concatStringsSep ", " ns} }";
|
|
in
|
|
lib.optional (v4 != [ ]) "oifname ${set uplinks} ip daddr ${list v4} drop"
|
|
++ lib.optional (v6 != [ ]) "oifname ${set uplinks} ip6 daddr ${list v6} drop";
|
|
|
|
# zone name -> devices of its members
|
|
zones = lib.mapAttrs (_: ms: map (m: m.device) ms) (lib.groupBy (m: m.zone) members);
|
|
zoneDevices = zone: zones.${zone} or [ ];
|
|
|
|
# Members of one zone may forward to each other, but never back out of the
|
|
# device they came in on (a tunnel's peers do not see each other).
|
|
intraZone = lib.concatLists (
|
|
lib.mapAttrsToList (
|
|
zone: devs:
|
|
lib.optionals (lib.length devs > 1) (
|
|
map (
|
|
d: "iifname ${set [ d ]} oifname ${set (lib.filter (x: x != d) devs)} accept # zone ${zone}"
|
|
) devs
|
|
)
|
|
) zones
|
|
);
|
|
|
|
setOf = xs: "{ ${lib.concatMapStringsSep ", " toString xs} }";
|
|
|
|
# Layer 4 match; `ports` may be ints or "a-b" ranges.
|
|
l4 =
|
|
proto: ports:
|
|
if proto == "any" then
|
|
""
|
|
else if proto == "icmp" then
|
|
"meta l4proto { icmp, ipv6-icmp } "
|
|
else
|
|
"${proto} dport ${if ports == [ ] then "1-65535" else setOf ports} ";
|
|
|
|
# Destination match, by family of the address.
|
|
daddrOf =
|
|
r:
|
|
lib.optionalString (r.destination != null) (
|
|
"${if isV6 r.destination then "ip6" else "ip"} daddr ${r.destination} "
|
|
);
|
|
|
|
# One variant per source family; no sources means one unrestricted variant.
|
|
# `key` is the family selector used for per-source rate limiting (null: both).
|
|
variantsOf =
|
|
r:
|
|
let
|
|
v4 = lib.filter (x: !isV6 x) r.sources;
|
|
v6 = lib.filter isV6 r.sources;
|
|
destFamily =
|
|
if r.destination == null then
|
|
null
|
|
else if isV6 r.destination then
|
|
"ip6"
|
|
else
|
|
"ip";
|
|
in
|
|
if r.sources == [ ] then
|
|
[
|
|
{
|
|
src = "";
|
|
key = destFamily;
|
|
}
|
|
]
|
|
else
|
|
lib.optional (v4 != [ ]) {
|
|
src = "ip saddr ${setOf v4} ";
|
|
key = "ip";
|
|
}
|
|
++ lib.optional (v6 != [ ]) {
|
|
src = "ip6 saddr ${setOf v6} ";
|
|
key = "ip6";
|
|
};
|
|
|
|
# Everything one rule contributes. Indexed so meters/prefixes are unique.
|
|
ruleParts =
|
|
i: r:
|
|
let
|
|
id = toString i;
|
|
label = "${r.from}->${r.to}";
|
|
fromDevs = if r.from == "wan" then uplinks else zoneDevices r.from;
|
|
toDevs = zoneDevices r.to;
|
|
# After DNAT the packet carries the translated port.
|
|
fwdPorts = if r.dnat && r.toPort != null then [ r.toPort ] else r.ports;
|
|
base = "iifname ${set fromDevs} oifname ${set toDevs} ${daddrOf r}${l4 r.protocol fwdPorts}${lib.optionalString r.dnat "ct status dnat "}";
|
|
logPrefix = what: ''log prefix "router fwd#${id} ${label} ${what}: " '';
|
|
limitLines =
|
|
v:
|
|
lib.optionals (r.rateLimit != null) (
|
|
map
|
|
(
|
|
k:
|
|
"${base}${v.src}ct state new meter rl${id}-${k} { ${k} saddr limit rate over ${r.rateLimit} } ${lib.optionalString r.log (logPrefix "rate-limited")}drop"
|
|
)
|
|
(
|
|
if v.key == null then
|
|
[
|
|
"ip"
|
|
"ip6"
|
|
]
|
|
else
|
|
[ v.key ]
|
|
)
|
|
);
|
|
acceptLines =
|
|
v:
|
|
lib.optional r.log "${base}${v.src}ct state new ${logPrefix "accepted"}"
|
|
++ [ "${base}${v.src}accept # ${label}" ];
|
|
dnatTarget = "dnat to ${r.destination}${
|
|
lib.optionalString (r.toPort != null) ":${toString r.toPort}"
|
|
}";
|
|
in
|
|
{
|
|
forward = lib.concatMap (v: limitLines v ++ acceptLines v) (variantsOf r);
|
|
prerouting =
|
|
lib.optionals r.dnat (
|
|
map (v: "iifname ${set uplinks} ${v.src}${l4 r.protocol r.ports}${dnatTarget} # ${label}") (
|
|
variantsOf r
|
|
)
|
|
)
|
|
# NAT loopback: internal clients addressing the router's public address.
|
|
++
|
|
lib.optional (r.dnat && r.hairpin)
|
|
"iifname ${set internetIfaces} fib daddr type local ip daddr != ${setOf internalAddrs} ${l4 r.protocol r.ports}${dnatTarget} # hairpin ${label}";
|
|
hairpinForward = lib.optional (r.dnat && r.hairpin) (
|
|
"iifname ${set internetIfaces} oifname ${set toDevs} ip daddr ${r.destination} ${l4 r.protocol fwdPorts}ct status dnat accept # hairpin ${label}"
|
|
);
|
|
};
|
|
|
|
parts = lib.imap0 ruleParts cfg.firewall.rules;
|
|
anyHairpin = lib.any (r: r.dnat && r.hairpin) cfg.firewall.rules;
|
|
# Addresses the router itself holds on internal interfaces; anything else
|
|
# that is local is a public (uplink) address.
|
|
internalAddrs =
|
|
map (l: l.ipv4.address) lans
|
|
++ map (a: builtins.head (lib.splitString "/" a)) (
|
|
lib.filter (a: !isV6 a) (lib.concatMap (w: w.addresses) wgs)
|
|
);
|
|
|
|
uplink4 = cfg.wan.ipv4.interface;
|
|
pppoe = cfg.wan.ipv4.type == "pppoe";
|
|
# IPv4 leaves via the PPP device, IPv6 via the physical uplink.
|
|
# When the physical link also carries LANs, only the PPP device is an uplink.
|
|
sharedLink = lib.elem cfg.wan.interface (map (l: l.interface) lans);
|
|
uplinks = lib.unique ([ uplink4 ] ++ lib.optional (!sharedLink) cfg.wan.interface);
|
|
mss = cfg.wan.ipv4.pppoe.mtu - 40;
|
|
dhcpIfaces = map (l: l.device) (lib.filter (l: l.dhcp.enable) lans);
|
|
in
|
|
{
|
|
config = lib.mkIf cfg.enable {
|
|
# The generated ruleset replaces networking.firewall entirely.
|
|
networking.firewall.enable = false;
|
|
networking.nftables.enable = true;
|
|
|
|
networking.nftables.tables.router = {
|
|
family = "inet";
|
|
content = ''
|
|
chain input {
|
|
type filter hook input priority filter; policy drop;
|
|
|
|
iifname "lo" accept
|
|
ct state established,related accept
|
|
ct state invalid drop
|
|
|
|
# Error types and ND are required on every interface (WAN included);
|
|
# echo is only answered on LANs.
|
|
icmp type { destination-unreachable, time-exceeded, parameter-problem } accept
|
|
icmpv6 type {
|
|
destination-unreachable, packet-too-big, time-exceeded, parameter-problem,
|
|
nd-router-solicit, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert
|
|
} accept
|
|
iifname ${set memberIfaces} icmp type echo-request accept
|
|
iifname ${set memberIfaces} icmpv6 type echo-request accept
|
|
|
|
${lib.optionalString (!pppoe) ''iifname "${cfg.wan.interface}" udp dport 68 accept''}
|
|
${lib.optionalString cfg.wan.ipv6.enable ''iifname "${cfg.wan.interface}" udp dport 546 accept''}
|
|
|
|
iifname ${set dnsIfaces} udp dport 53 accept
|
|
iifname ${set dnsIfaces} tcp dport 53 accept
|
|
${lib.optionalString (listenPorts != [ ])
|
|
"iifname ${set uplinks} udp dport { ${
|
|
lib.concatMapStringsSep ", " toString listenPorts
|
|
} } accept # wireguard"
|
|
}
|
|
${lib.optionalString (dhcpIfaces != [ ]) "iifname ${set dhcpIfaces} udp dport 67 accept"}
|
|
${lib.optionalString (mgmtIfaces != [ ]) "iifname ${set mgmtIfaces} tcp dport 22 accept"}
|
|
}
|
|
|
|
chain forward {
|
|
type filter hook forward priority filter; policy drop;
|
|
|
|
${lib.concatStringsSep "\n " killRules}
|
|
|
|
ct state established,related accept
|
|
ct state invalid drop
|
|
|
|
icmpv6 type { destination-unreachable, packet-too-big, time-exceeded, parameter-problem } accept
|
|
|
|
${lib.optionalString pppoe ''
|
|
# Clamp MSS to the PPP MTU in both directions (never raised).
|
|
iifname "${uplink4}" tcp flags syn tcp option maxseg size > ${toString mss} tcp option maxseg size set ${toString mss}
|
|
oifname "${uplink4}" tcp flags syn tcp option maxseg size > ${toString mss} tcp option maxseg size set ${toString mss}
|
|
''}
|
|
${lib.optionalString (
|
|
internetIfaces != [ ]
|
|
) "iifname ${set internetIfaces} oifname ${set uplinks} accept"}
|
|
|
|
# Zones: free inside a zone, denied between zones unless a rule says so.
|
|
${lib.concatStringsSep "\n " (
|
|
intraZone ++ lib.concatMap (p: p.hairpinForward ++ p.forward) parts
|
|
)}
|
|
}
|
|
'';
|
|
};
|
|
|
|
networking.nftables.tables.router-nat = {
|
|
family = "ip";
|
|
content = ''
|
|
chain prerouting {
|
|
type nat hook prerouting priority dstnat; policy accept;
|
|
${lib.concatStringsSep "\n " (lib.concatMap (p: p.prerouting) parts)}
|
|
}
|
|
|
|
chain postrouting {
|
|
type nat hook postrouting priority srcnat; policy accept;
|
|
oifname "${uplink4}" masquerade
|
|
${lib.optionalString anyHairpin "ct status dnat iifname ${set memberIfaces} oifname ${set memberIfaces} masquerade # hairpin"}
|
|
${lib.optionalString (
|
|
masqueradeIfaces != [ ]
|
|
) "oifname ${set masqueradeIfaces} masquerade # tunnels"}
|
|
}
|
|
'';
|
|
};
|
|
|
|
services.openssh = {
|
|
enable = true;
|
|
openFirewall = false;
|
|
settings = {
|
|
PasswordAuthentication = false;
|
|
KbdInteractiveAuthentication = false;
|
|
PermitRootLogin = "prohibit-password";
|
|
};
|
|
};
|
|
};
|
|
}
|