chayleaf/dotfiles
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

router: add sit tunnel option

Browse source
This commit is contained in:
chayleaf 2024-07-03 22:49:28 +07:00
parent 0cc911f974
commit d40bdb7415
Signed by: chayleaf
GPG key ID: 78171AD46227E68E
4 changed files with 46 additions and 17 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
flake.lock
View file

@ -510,11 +510,11 @@
]
},
"locked": {
"lastModified": 1718217962,
"narHash": "sha256-bVKwJdVeo6wMN6xMOFx3Um3x7ebijyCG5iGCIXAtDXA=",
"lastModified": 1720021052,
"narHash": "sha256-tu8IQn8Kj7S0xRg0L2ej7S65FzXqSX7LI7M2pbLdQJU=",
"owner": "chayleaf",
"repo": "nixos-router",
"rev": "f25509e55a06f1dfa089556b28b9402c13e18aa4",
"rev": "4c132c4c5fc09b3c3317b960ec1533c4a5ebe41f",
"type": "github"
},
"original": {

2
flake.nix
View file

@ -86,7 +86,7 @@
if dev.${name} or false then
(if input._type or null == "flake"
then let inputs = input.inputs // { self = (import /${devPath}/${name}/flake.nix).outputs inputs; };
in { __toString = _: "/${devPath}/${name}"; } // inputs.self
in { __toString = _: "/${toString devPath}/${name}"; } // inputs.self
else /${devPath}/${name})
else input)
base-inputs;

40
system/hosts/router/default.nix
View file

@ -414,6 +414,21 @@ in {
};
*/
# ethernet wan
router.tunnels.sittun0 = lib.mkIf (cfg.vpn.tunnel.mode == "sit") {
mode = "sit";
remote = cfg.vpn.tunnel.ip;
local = cfg.vpn.tunnel.localIp;
ttl = 255;
};
router.interfaces.sittun0 = lib.mkIf (cfg.vpn.tunnel.mode == "sit") {
dependentServices = [
(lib.mkIf cfg.vpn.wireguard.enable { service = "wireguard-${vpn_iface}"; inNetns = false; })
(lib.mkIf cfg.vpn.openvpn.enable { service = "openvpn-client"; inNetns = false; })
];
ipv6.addresses = [ (router-lib.parseCidr cfg.vpn.tunnel.ifaceAddr) ];
ipv6.routes = [ { extraArgs = [ "::/0" "dev" "sittun0" ]; } ];
networkNamespace = "wan";
};
router.interfaces.wan = {
dependentServices = [
(lib.mkIf cfg.vpn.wireguard.enable { service = "wireguard-${vpn_iface}"; inNetns = false; })
@ -703,11 +718,13 @@ in {
};
router.networkNamespaces.wan = {
# this is the even more boring nftables config
nftables.jsonRules = mkRules {
nftables.jsonRules = let
wans = [ "wan" ] ++ lib.optional (cfg.vpn.tunnel.mode == "sit") "sittun0";
in mkRules {
selfIp4 = netAddresses.netnsWan4;
selfIp6 = netAddresses.netnsWan6;
inherit wans;
lans = [ "veth-wan-b" ];
wans = [ "wan" ];
netdevIngressWanRules = with notnft.dsl; with payload; [
[(is.eq (fib (f: with f; [ saddr mark iif ]) (f: f.oif)) missing) (log "wan oif missing ") drop]
];
@ -718,10 +735,10 @@ in {
rule4 = rule.target4; rule6 = rule.target6;
in with notnft.dsl; with payload;
lib.optionals (rule4 != null) [
[ (is.eq meta.iifname "wan") (is.eq ip.protocol protocols) (is.eq th.dport rule.port)
[ (is.eq meta.iifname (setIfNeeded wans)) (is.eq ip.protocol protocols) (is.eq th.dport rule.port)
(if rule4.port == null then dnat.ip rule4.address else dnat.ip rule4.address rule4.port) ]
] ++ lib.optionals (rule6 != null) [
[ (is.eq meta.iifname "wan") (is.eq ip6.nexthdr protocols) (is.eq th.dport rule.port)
[ (is.eq meta.iifname (setIfNeeded wans)) (is.eq ip6.nexthdr protocols) (is.eq th.dport rule.port)
(if rule6.port == null then dnat.ip6 rule6.address else dnat.ip6 rule6.address rule6.port) ]
])
(builtins.filter (x: !x.inVpn && (x.tcp || x.udp)) cfg.dnatRules));
@ -734,10 +751,10 @@ in {
rule4 = rule.target4; rule6 = rule.target6;
in with notnft.dsl; with payload;
lib.optionals (rule4 != null) [
[ (is.eq meta.iifname "wan") (is.eq meta.oifname "veth-wan-b") (is.eq ip.protocol protocols)
[ (is.eq meta.iifname (setIfNeeded wans)) (is.eq meta.oifname "veth-wan-b") (is.eq ip.protocol protocols)
(is.eq th.dport (if rule4.port != null then rule4.port else rule.port)) (is.eq ip.daddr rule4.address) masquerade ]
] ++ lib.optionals (rule6 != null) [
[ (is.eq meta.iifname "wan") (is.eq meta.oifname "veth-wan-b") (is.eq ip6.nexthdr protocols)
[ (is.eq meta.iifname (setIfNeeded wans)) (is.eq meta.oifname "veth-wan-b") (is.eq ip6.nexthdr protocols)
(is.eq th.dport (if rule6.port != null then rule6.port else rule.port)) (is.eq ip6.daddr rule6.address) masquerade ]
])
(builtins.filter (x: !x.inVpn && (x.tcp || x.udp) && dnatRuleMode x == "snat") cfg.dnatRules));
@ -764,12 +781,13 @@ in {
# vpn socket is in wan namespace, meaning traffic gets sent through the wan namespace
# vpn interface is in default namespace, meaning it can be used in the default namespace
# networking.wireguard.interfaces.${vpn_iface} = cfg.vpn.wireguard.config // {
# socketNamespace = "wan";
# interfaceNamespace = "init";
# };
networking.wireguard.interfaces.${vpn_iface} = lib.mkIf cfg.vpn.wireguard.enable
(cfg.vpn.wireguard.config // {
socketNamespace = "wan";
interfaceNamespace = "init";
});
systemd.services.vpn-tunnel = {
systemd.services.vpn-tunnel = lib.mkIf (cfg.vpn.tunnel.mode == "ssh") {
description = "VPN Tunnel";
wantedBy = [
"multi-user.target"

15
system/hosts/router/options.nix
View file

@ -7,7 +7,18 @@
options.router-settings = {
vpn = {
tunnel = {
enable = lib.mkEnableOption "VPN tunnel";
mode = lib.mkOption {
description = "tunnel mode";
type = with lib.types; nullOr (enum [ "ssh" "sit" ]);
};
ifaceAddr = lib.mkOption {
description = "interface cidr";
type = router-lib.types.cidr;
};
localIp = lib.mkOption {
description = "local ip";
type = router-lib.types.ip;
};
localPort = lib.mkOption {
description = "local port";
type = lib.types.port;
@ -18,7 +29,7 @@
};
ip = lib.mkOption {
description = "remote ip";
type = router-lib.types.ipv4;
type = router-lib.types.ip;
};
port = lib.mkOption {
description = "SSH port";