summaryrefslogtreecommitdiff
path: root/hosts/vidhar/network
diff options
context:
space:
mode:
authorGregor Kleen <gkleen@yggdrasil.li>2024-08-08 14:36:50 +0200
committerGregor Kleen <gkleen@yggdrasil.li>2024-08-08 14:36:50 +0200
commitbe06f04babc12fb60366c24a22561c1d46895c80 (patch)
tree8df057a3605a7272cb048043be7593b5c944a67c /hosts/vidhar/network
parenta6754d729f2d16cfdcb3570891c038a14718de1f (diff)
parentbc90ef66903e78713db1fd3a700785572b794cde (diff)
downloadnixos-be06f04babc12fb60366c24a22561c1d46895c80.tar
nixos-be06f04babc12fb60366c24a22561c1d46895c80.tar.gz
nixos-be06f04babc12fb60366c24a22561c1d46895c80.tar.bz2
nixos-be06f04babc12fb60366c24a22561c1d46895c80.tar.xz
nixos-be06f04babc12fb60366c24a22561c1d46895c80.zip
Merge commit 'bc90ef66' into flakes
Diffstat (limited to 'hosts/vidhar/network')
-rw-r--r--hosts/vidhar/network/default.nix2
-rw-r--r--hosts/vidhar/network/gpon.nix (renamed from hosts/vidhar/network/dsl.nix)14
-rw-r--r--hosts/vidhar/network/ruleset.nft72
3 files changed, 47 insertions, 41 deletions
diff --git a/hosts/vidhar/network/default.nix b/hosts/vidhar/network/default.nix
index 4a792851..0643f0bb 100644
--- a/hosts/vidhar/network/default.nix
+++ b/hosts/vidhar/network/default.nix
@@ -3,7 +3,7 @@
3with lib; 3with lib;
4 4
5{ 5{
6 imports = [ ./dsl.nix ./bifrost ./dhcp ]; 6 imports = [ ./gpon.nix ./bifrost ./dhcp ];
7 7
8 config = { 8 config = {
9 networking = { 9 networking = {
diff --git a/hosts/vidhar/network/dsl.nix b/hosts/vidhar/network/gpon.nix
index 1e8e9c73..1628159c 100644
--- a/hosts/vidhar/network/dsl.nix
+++ b/hosts/vidhar/network/gpon.nix
@@ -8,7 +8,7 @@ in {
8 options = { 8 options = {
9 networking.pppInterface = mkOption { 9 networking.pppInterface = mkOption {
10 type = types.str; 10 type = types.str;
11 default = "dsl"; 11 default = "gpon";
12 }; 12 };
13 }; 13 };
14 14
@@ -34,7 +34,7 @@ in {
34 plugin pppoe.so 34 plugin pppoe.so
35 name telekom 35 name telekom
36 user 002576900250551137425220#0001@t-online.de 36 user 002576900250551137425220#0001@t-online.de
37 telekom 37 nic-telekom
38 debug 38 debug
39 +ipv6 39 +ipv6
40 ''; 40 '';
@@ -45,6 +45,12 @@ in {
45 serviceConfig = { 45 serviceConfig = {
46 PIDFile = "/run/pppd/${pppInterface}.pid"; 46 PIDFile = "/run/pppd/${pppInterface}.pid";
47 }; 47 };
48 restartTriggers = with config; [
49 environment.etc."ppp/ip-pre-up".source
50 environment.etc."ppp/ip-up".source
51 environment.etc."ppp/ip-down".source
52 # sops.secrets."pap-secrets".sopsFile
53 ];
48 }; 54 };
49 sops.secrets."pap-secrets" = { 55 sops.secrets."pap-secrets" = {
50 format = "binary"; 56 format = "binary";
@@ -70,8 +76,8 @@ in {
70 76
71 tc qdisc add dev "${pppInterface}" handle ffff: ingress 77 tc qdisc add dev "${pppInterface}" handle ffff: ingress
72 tc filter add dev "${pppInterface}" parent ffff: basic action ctinfo dscp 0x0000003f 0x00000040 action mirred egress redirect dev "ifb4${pppInterface}" 78 tc filter add dev "${pppInterface}" parent ffff: basic action ctinfo dscp 0x0000003f 0x00000040 action mirred egress redirect dev "ifb4${pppInterface}"
73 tc qdisc replace dev "ifb4${pppInterface}" root cake memlimit 64Mb pppoe-ptm diffserv4 bandwidth 93mbit 79 tc qdisc replace dev "ifb4${pppInterface}" root cake memlimit 128Mb overhead 35 mpu 74 regional diffserv4 bandwidth 285mbit
74 tc qdisc replace dev "${pppInterface}" root cake memlimit 64Mb pppoe-ptm nat diffserv4 wash bandwidth 35mbit 80 tc qdisc replace dev "${pppInterface}" root cake memlimit 128Mb overhead 35 mpu 74 regional nat diffserv4 wash bandwidth 143mbit
75 ''; 81 '';
76 }; 82 };
77 in "${app}/bin/${app.meta.mainProgram}"; 83 in "${app}/bin/${app.meta.mainProgram}";
diff --git a/hosts/vidhar/network/ruleset.nft b/hosts/vidhar/network/ruleset.nft
index 6eb97f85..9f519302 100644
--- a/hosts/vidhar/network/ruleset.nft
+++ b/hosts/vidhar/network/ruleset.nft
@@ -4,15 +4,15 @@ table arp filter {
4 limit lim_arp_local { 4 limit lim_arp_local {
5 rate over 50 mbytes/second burst 50 mbytes 5 rate over 50 mbytes/second burst 50 mbytes
6 } 6 }
7 limit lim_arp_dsl { 7 limit lim_arp_gpon {
8 rate over 1400 kbytes/second burst 1400 kbytes 8 rate over 7500 kbytes/second burst 7500 kbytes
9 } 9 }
10 10
11 counter arp-rx {} 11 counter arp-rx {}
12 counter arp-tx {} 12 counter arp-tx {}
13 13
14 counter arp-ratelimit-dsl-rx {} 14 counter arp-ratelimit-gpon-rx {}
15 counter arp-ratelimit-dsl-tx {} 15 counter arp-ratelimit-gpon-tx {}
16 16
17 counter arp-ratelimit-local-rx {} 17 counter arp-ratelimit-local-rx {}
18 counter arp-ratelimit-local-tx {} 18 counter arp-ratelimit-local-tx {}
@@ -21,8 +21,8 @@ table arp filter {
21 type filter hook input priority filter 21 type filter hook input priority filter
22 policy accept 22 policy accept
23 23
24 iifname != dsl limit name lim_arp_local counter name arp-ratelimit-local-rx drop 24 iifname != gpon limit name lim_arp_local counter name arp-ratelimit-local-rx drop
25 iifname dsl limit name lim_arp_dsl counter name arp-ratelimit-dsl-rx drop 25 iifname gpon limit name lim_arp_gpon counter name arp-ratelimit-gpon-rx drop
26 26
27 counter name arp-rx 27 counter name arp-rx
28 } 28 }
@@ -31,8 +31,8 @@ table arp filter {
31 type filter hook output priority filter 31 type filter hook output priority filter
32 policy accept 32 policy accept
33 33
34 oifname != dsl limit name lim_arp_local counter name arp-ratelimit-local-tx drop 34 oifname != gpon limit name lim_arp_local counter name arp-ratelimit-local-tx drop
35 oifname dsl limit name lim_arp_dsl counter name arp-ratelimit-dsl-tx drop 35 oifname gpon limit name lim_arp_gpon counter name arp-ratelimit-gpon-tx drop
36 36
37 counter name arp-tx 37 counter name arp-tx
38 } 38 }
@@ -46,11 +46,11 @@ table inet filter {
46 limit lim_icmp_local { 46 limit lim_icmp_local {
47 rate over 50 mbytes/second burst 50 mbytes 47 rate over 50 mbytes/second burst 50 mbytes
48 } 48 }
49 limit lim_icmp_dsl { 49 limit lim_icmp_gpon {
50 rate over 1400 kbytes/second burst 1400 kbytes 50 rate over 7500 kbytes/second burst 7500 kbytes
51 } 51 }
52 52
53 counter icmp-ratelimit-dsl-fw {} 53 counter icmp-ratelimit-gpon-fw {}
54 counter icmp-ratelimit-local-fw {} 54 counter icmp-ratelimit-local-fw {}
55 55
56 counter icmp-fw {} 56 counter icmp-fw {}
@@ -58,7 +58,7 @@ table inet filter {
58 counter invalid-fw {} 58 counter invalid-fw {}
59 counter fw-lo {} 59 counter fw-lo {}
60 counter fw-lan {} 60 counter fw-lan {}
61 counter fw-dsl {} 61 counter fw-gpon {}
62 62
63 counter fw-cups {} 63 counter fw-cups {}
64 64
@@ -73,7 +73,7 @@ table inet filter {
73 counter invalid-local4-rx {} 73 counter invalid-local4-rx {}
74 counter invalid-local6-rx {} 74 counter invalid-local6-rx {}
75 75
76 counter icmp-ratelimit-dsl-rx {} 76 counter icmp-ratelimit-gpon-rx {}
77 counter icmp-ratelimit-local-rx {} 77 counter icmp-ratelimit-local-rx {}
78 counter icmp-rx {} 78 counter icmp-rx {}
79 79
@@ -101,7 +101,7 @@ table inet filter {
101 101
102 counter tx-lo {} 102 counter tx-lo {}
103 103
104 counter icmp-ratelimit-dsl-tx {} 104 counter icmp-ratelimit-gpon-tx {}
105 counter icmp-ratelimit-local-tx {} 105 counter icmp-ratelimit-local-tx {}
106 counter icmp-tx {} 106 counter icmp-tx {}
107 107
@@ -123,10 +123,10 @@ table inet filter {
123 123
124 124
125 chain forward_icmp_accept { 125 chain forward_icmp_accept {
126 oifname { dsl, bifrost } limit name lim_icmp_dsl counter name icmp-ratelimit-dsl-fw drop 126 oifname { gpon, bifrost } limit name lim_icmp_gpon counter name icmp-ratelimit-gpon-fw drop
127 iifname { dsl, bifrost } limit name lim_icmp_dsl counter name icmp-ratelimit-dsl-fw drop 127 iifname { gpon, bifrost } limit name lim_icmp_gpon counter name icmp-ratelimit-gpon-fw drop
128 oifname != { dsl, bifrost } limit name lim_icmp_local counter name icmp-ratelimit-local-fw drop 128 oifname != { gpon, bifrost } limit name lim_icmp_local counter name icmp-ratelimit-local-fw drop
129 iifname != { dsl, bifrost } limit name lim_icmp_local counter name icmp-ratelimit-local-fw drop 129 iifname != { gpon, bifrost } limit name lim_icmp_local counter name icmp-ratelimit-local-fw drop
130 counter name icmp-fw accept 130 counter name icmp-fw accept
131 } 131 }
132 chain forward { 132 chain forward {
@@ -139,10 +139,10 @@ table inet filter {
139 139
140 iifname lo counter name fw-lo accept 140 iifname lo counter name fw-lo accept
141 141
142 oifname { lan, dsl, bifrost } meta l4proto $icmp_protos jump forward_icmp_accept 142 oifname { lan, gpon, bifrost } meta l4proto $icmp_protos jump forward_icmp_accept
143 iifname lan oifname { dsl, bifrost } counter name fw-lan accept 143 iifname lan oifname { gpon, bifrost } counter name fw-lan accept
144 144
145 iifname dsl oifname lan ct state { established, related } counter name fw-dsl accept 145 iifname gpon oifname lan ct state { established, related } counter name fw-gpon accept
146 146
147 147
148 limit name lim_reject log level debug prefix "drop forward: " counter name reject-ratelimit-fw drop 148 limit name lim_reject log level debug prefix "drop forward: " counter name reject-ratelimit-fw drop
@@ -163,22 +163,22 @@ table inet filter {
163 iif != lo ip daddr 127.0.0.1/8 counter name invalid-local4-rx reject 163 iif != lo ip daddr 127.0.0.1/8 counter name invalid-local4-rx reject
164 iif != lo ip6 daddr ::1/128 counter name invalid-local6-rx reject 164 iif != lo ip6 daddr ::1/128 counter name invalid-local6-rx reject
165 165
166 iifname { bifrost, dsl } meta l4proto $icmp_protos limit name lim_icmp_dsl counter name icmp-ratelimit-dsl-rx drop 166 iifname { bifrost, gpon } meta l4proto $icmp_protos limit name lim_icmp_gpon counter name icmp-ratelimit-gpon-rx drop
167 iifname != { bifrost, dsl } meta l4proto $icmp_protos limit name lim_icmp_local counter name icmp-ratelimit-local-rx drop 167 iifname != { bifrost, gpon } meta l4proto $icmp_protos limit name lim_icmp_local counter name icmp-ratelimit-local-rx drop
168 meta l4proto $icmp_protos counter name icmp-rx accept 168 meta l4proto $icmp_protos counter name icmp-rx accept
169 169
170 iifname { lan, mgmt, dsl, yggdrasil, bifrost } tcp dport 22 counter name ssh-rx accept 170 iifname { lan, mgmt, gpon, yggdrasil, bifrost } tcp dport 22 counter name ssh-rx accept
171 iifname { lan, mgmt, dsl, yggdrasil, bifrost } udp dport 60000-61000 counter name mosh-rx accept 171 iifname { lan, mgmt, gpon, yggdrasil, bifrost } udp dport 60000-61000 counter name mosh-rx accept
172 172
173 iifname { lan, mgmt, wifibh, yggdrasil } meta l4proto { tcp, udp } th dport 53 counter name dns-rx accept 173 iifname { lan, mgmt, wifibh, yggdrasil } meta l4proto { tcp, udp } th dport 53 counter name dns-rx accept
174 174
175 iifname { lan, yggdrasil } tcp dport 2049 counter name nfs-rx accept 175 iifname { lan, yggdrasil } tcp dport 2049 counter name nfs-rx accept
176 176
177 iifname { lan, mgmt, dsl } meta protocol ip udp dport 51820 counter name wg-rx accept 177 iifname { lan, mgmt, gpon } meta protocol ip udp dport 51820 counter name wg-rx accept
178 iifname { lan, mgmt, dsl } meta protocol ip6 udp dport 51821 counter name wg-rx accept 178 iifname { lan, mgmt, gpon } meta protocol ip6 udp dport 51821 counter name wg-rx accept
179 iifname "yggdrasil-wg-*" meta l4proto gre counter name yggdrasil-gre-rx accept 179 iifname "yggdrasil-wg-*" meta l4proto gre counter name yggdrasil-gre-rx accept
180 180
181 iifname dsl meta protocol ip6 udp dport 546 udp sport 547 counter name ipv6-pd-rx accept 181 iifname gpon meta protocol ip6 udp dport 546 udp sport 547 counter name ipv6-pd-rx accept
182 182
183 iifname mgmt udp dport 123 counter name ntp-rx accept 183 iifname mgmt udp dport 123 counter name ntp-rx accept
184 184
@@ -209,8 +209,8 @@ table inet filter {
209 209
210 oifname lo counter name tx-lo accept 210 oifname lo counter name tx-lo accept
211 211
212 oifname { bifrost, dsl } meta l4proto $icmp_protos limit name lim_icmp_dsl counter name icmp-ratelimit-dsl-tx drop 212 oifname { bifrost, gpon } meta l4proto $icmp_protos limit name lim_icmp_gpon counter name icmp-ratelimit-gpon-tx drop
213 oifname != { bifrost, dsl } meta l4proto $icmp_protos limit name lim_icmp_local counter name icmp-ratelimit-local-tx drop 213 oifname != { bifrost, gpon } meta l4proto $icmp_protos limit name lim_icmp_local counter name icmp-ratelimit-local-tx drop
214 meta l4proto $icmp_protos counter name icmp-tx accept 214 meta l4proto $icmp_protos counter name icmp-tx accept
215 215
216 216
@@ -246,7 +246,7 @@ table inet filter {
246} 246}
247 247
248table inet nat { 248table inet nat {
249 counter dsl-nat {} 249 counter gpon-nat {}
250 # counter container-nat {} 250 # counter container-nat {}
251 251
252 chain postrouting { 252 chain postrouting {
@@ -254,20 +254,20 @@ table inet nat {
254 policy accept 254 policy accept
255 255
256 256
257 meta nfproto ipv4 oifname dsl counter name dsl-nat masquerade 257 meta nfproto ipv4 oifname gpon counter name gpon-nat masquerade
258 # iifname ve-* oifname dsl counter name container-nat masquerade 258 # iifname ve-* oifname gpon counter name container-nat masquerade
259 } 259 }
260} 260}
261 261
262table inet mss_clamp { 262table inet mss_clamp {
263 counter dsl-mss-clamp {} 263 counter gpon-mss-clamp {}
264 264
265 chain postrouting { 265 chain postrouting {
266 type filter hook postrouting priority mangle 266 type filter hook postrouting priority mangle
267 policy accept 267 policy accept
268 268
269 269
270 oifname dsl tcp flags & (syn|rst) == syn counter name dsl-mss-clamp tcp option maxseg size set rt mtu 270 oifname gpon tcp flags & (syn|rst) == syn counter name gpon-mss-clamp tcp option maxseg size set rt mtu
271 } 271 }
272} 272}
273 273
@@ -402,7 +402,7 @@ table inet dscpclassify {
402 chain postrouting { 402 chain postrouting {
403 type filter hook postrouting priority filter + 1; policy accept 403 type filter hook postrouting priority filter + 1; policy accept
404 404
405 oifname != dsl return 405 oifname != gpon return
406 406
407 ip dscp cs0 goto ct_set_cs0 407 ip dscp cs0 goto ct_set_cs0
408 ip dscp lephb goto ct_set_lephb 408 ip dscp lephb goto ct_set_lephb