From 68f7b6dcf0d388ea14b0782fb62f6cb7b7ea941c Mon Sep 17 00:00:00 2001
From: Gregor Kleen <gkleen@yggdrasil.li>
Date: Tue, 9 Jul 2024 14:24:14 +0200
Subject: dsl -> gpon

---
 hosts/vidhar/network/default.nix |   2 +-
 hosts/vidhar/network/dsl.nix     | 265 ---------------------------------------
 hosts/vidhar/network/gpon.nix    | 265 +++++++++++++++++++++++++++++++++++++++
 hosts/vidhar/network/ruleset.nft |  72 +++++------
 4 files changed, 302 insertions(+), 302 deletions(-)
 delete mode 100644 hosts/vidhar/network/dsl.nix
 create mode 100644 hosts/vidhar/network/gpon.nix

(limited to 'hosts/vidhar/network')

diff --git a/hosts/vidhar/network/default.nix b/hosts/vidhar/network/default.nix
index e961c17e..cbfbb65a 100644
--- a/hosts/vidhar/network/default.nix
+++ b/hosts/vidhar/network/default.nix
@@ -3,7 +3,7 @@
 with lib;
 
 {
-  imports = [ ./dsl.nix ./bifrost ./dhcp ];
+  imports = [ ./gpon.nix ./bifrost ./dhcp ];
 
   config = {
     networking = {
diff --git a/hosts/vidhar/network/dsl.nix b/hosts/vidhar/network/dsl.nix
deleted file mode 100644
index 1e8e9c73..00000000
--- a/hosts/vidhar/network/dsl.nix
+++ /dev/null
@@ -1,265 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-with lib;
-
-let
-  pppInterface = config.networking.pppInterface;
-in {
-  options = {
-    networking.pppInterface = mkOption {
-      type = types.str;
-      default = "dsl";
-    };
-  };
-
-  config = {
-    networking.vlans = {
-      telekom = {
-        id = 7;
-        interface = "eno2";
-      };
-    };
-
-    services.pppd = {
-      enable = true;
-      peers.telekom.config = ''
-        nodefaultroute
-        ifname ${pppInterface}
-        lcp-echo-adaptive
-        lcp-echo-failure 5
-        lcp-echo-interval 1
-        maxfail 0
-        mtu 1492
-        mru 1492
-        plugin pppoe.so
-        name telekom
-        user 002576900250551137425220#0001@t-online.de
-        telekom
-        debug
-        +ipv6
-      '';
-    };
-    systemd.services."pppd-telekom" = {
-      stopIfChanged = true;
-
-      serviceConfig = {
-        PIDFile = "/run/pppd/${pppInterface}.pid";
-      };
-    };
-    sops.secrets."pap-secrets" = {
-      format = "binary";
-      sopsFile = ./pap-secrets;
-      path = "/etc/ppp/pap-secrets";
-    };
-
-    environment.etc = {
-      "ppp/ip-pre-up".source = let
-        app = pkgs.writeShellApplication {
-          name = "ip-pre-up";
-          runtimeInputs = with pkgs; [ iproute2 ethtool ];
-          text = ''
-            ethtool -K telekom tso off gso off gro off
-
-            ip link del "ifb4${pppInterface}" || true
-            ip link add name "ifb4${pppInterface}" type ifb
-            ip link set "ifb4${pppInterface}" up
-
-            tc qdisc del dev "ifb4${pppInterface}" root || true
-            tc qdisc del dev "${pppInterface}" ingress || true
-            tc qdisc del dev "${pppInterface}" root || true
-
-            tc qdisc add dev "${pppInterface}" handle ffff: ingress
-            tc filter add dev "${pppInterface}" parent ffff: basic action ctinfo dscp 0x0000003f 0x00000040 action mirred egress redirect dev "ifb4${pppInterface}"
-            tc qdisc replace dev "ifb4${pppInterface}" root cake memlimit 64Mb pppoe-ptm diffserv4 bandwidth 93mbit
-            tc qdisc replace dev "${pppInterface}" root cake memlimit 64Mb pppoe-ptm nat diffserv4 wash bandwidth 35mbit
-          '';
-        };
-      in "${app}/bin/${app.meta.mainProgram}";
-      "ppp/ip-up".source = let
-        app = pkgs.writeShellApplication {
-          name = "ip-up";
-          runtimeInputs = with pkgs; [ iproute2 ];
-          text = ''
-            ip route add default via "$5" dev "${pppInterface}" metric 512
-          '';
-        };
-      in "${app}/bin/${app.meta.mainProgram}";
-      "ppp/ip-down".source = let
-        app = pkgs.writeShellApplication {
-          name = "ip-down";
-          runtimeInputs = with pkgs; [ iproute2 ];
-          text = ''
-            ip link del "ifb4${pppInterface}"
-          '';
-        };
-      in "${app}/bin/${app.meta.mainProgram}";
-    };
-
-    systemd.network.networks.${pppInterface} = {
-      matchConfig = {
-        Name = pppInterface;
-      };
-      dns = [ "::1" "127.0.0.1" ];
-      domains = [ "~." ];
-      networkConfig = {
-        LinkLocalAddressing = "no";
-        DNSSEC = true;
-      };
-    };
-
-    services.corerad = {
-      enable = true;
-      settings = {
-        interfaces = [
-          { name = pppInterface;
-            monitor = true;
-            verbose = true;
-          }
-          { name = "lan";
-            advertise = true;
-            verbose = true;
-            prefix = [{ prefix = "::/64"; }];
-            route = [{ prefix = "::/0"; }];
-            rdnss = [{ servers = ["::"]; }];
-            dnssl = [{ domain_names = ["yggdrasil"]; }];
-            # other_config = true;
-          }
-        ];
-
-        debug = {
-          address = "localhost:9430";
-          prometheus = true;
-        };
-      };
-    };
-    services.ndppd = {
-      enable = true;
-      proxies = {
-        ${pppInterface} = {
-          router = true;
-          rules = {
-            lan = {
-              method = "iface";
-              interface = "lan";
-              network = "::/0";
-            };
-          };
-        };
-      };
-    };
-    boot.kernelModules = [ "ifb" ];
-    boot.kernel.sysctl = {
-      "net.ipv6.conf.all.forwarding" = true;
-      "net.ipv6.conf.default.forwarding" = true;
-      "net.ipv4.conf.all.forwarding" = true;
-      "net.ipv4.conf.default.forwarding" = true;
-
-      "net.core.rmem_max" = 4194304;
-      "net.core.wmem_max" = 4194304;
-    };
-    systemd.services."pppd-telekom" = {
-      bindsTo = [ "sys-subsystem-net-devices-telekom.device" ];
-      after = [ "sys-subsystem-net-devices-telekom.device" ];
-    };
-    systemd.services."dhcpcd-${pppInterface}" = {
-      wantedBy = [ "multi-user.target" "network-online.target" "pppd-telekom.service" ];
-      bindsTo = [ "pppd-telekom.service" ];
-      after = [ "pppd-telekom.service" ];
-      wants = [ "network.target" ];
-      before = [ "network-online.target" ];
-
-      path = with pkgs; [ dhcpcd nettools openresolv ];
-      unitConfig.ConditionCapability = "CAP_NET_ADMIN";
-
-      stopIfChanged = true;
-
-      preStart = ''
-        i=0
-
-        while [[ -z "$(${pkgs.iproute2}/bin/ip -6 addr show dev ${pppInterface} scope link)" ]]; do
-          ${pkgs.coreutils}/bin/sleep 0.1
-          i=$((i + 1))
-          if [[ "$i" -ge 10 ]]; then
-            exit 1
-          fi
-        done
-      '';
-
-      postStop = ''
-        for dev in lan; do
-          ${pkgs.iproute2}/bin/ip -6 a show dev "''${dev}" scope global | ${pkgs.gnugrep}/bin/grep inet6 | ${pkgs.gawk}/bin/awk '{ print $2; }' | ${pkgs.findutils}/bin/xargs -I '{}' -- ${pkgs.iproute2}/bin/ip addr del '{}' dev "''${dev}"
-        done
-      '';
-
-      serviceConfig = let
-        dhcpcdConf = pkgs.writeText "dhcpcd.conf" ''
-          duid
-          vendorclassid
-          ipv6only
-
-          nooption domain_name_servers, domain_name, domain_search
-          option classless_static_routes
-          option interface_mtu
-
-          option host_name
-          option rapid_commit
-          require dhcp_server_identifier
-          slaac private
-
-          nohook resolv.conf
-          ipv6ra_autoconf
-          iaid 1195061668
-          ipv6rs                 # enable routing solicitation for WAN adapter
-          ia_pd 1 lan/0/64/0     # request a PD and assign it to the LAN
-
-          reboot 0
-
-          waitip 6
-        '';
-      in {
-        Type = "forking";
-        PIDFile = "/var/run/dhcpcd/${pppInterface}.pid";
-        RuntimeDirectory = "dhcpcd";
-        ExecStart = "@${pkgs.dhcpcd}/sbin/dhcpcd dhcpcd -q --config ${dhcpcdConf} ${pppInterface}";
-        ExecReload = "${pkgs.dhcpcd}/sbin/dhcpcd --rebind ${pppInterface}";
-        Restart = "always";
-        RestartSec = "5";
-      };
-    };
-    systemd.services.ndppd = {
-      wantedBy = [ "dhcpcd-${pppInterface}.service" ];
-      bindsTo = [ "dhcpcd-${pppInterface}.service" ];
-      after = [ "dhcpcd-${pppInterface}.service" ];
-
-      serviceConfig = {
-        Restart = "always";
-        RestartSec = "5";
-      };
-    };
-    systemd.services.corerad = {
-      wantedBy = [ "dhcpcd-${pppInterface}.service" ];
-      bindsTo = [ "dhcpcd-${pppInterface}.service" ];
-      after = [ "dhcpcd-${pppInterface}.service" ];
-
-      serviceConfig = {
-        Restart = lib.mkForce "always";
-        RestartSec = "5";
-      };
-    };
-    users.users.dhcpcd = {
-      isSystemUser = true;
-      group = "dhcpcd";
-    };
-    users.groups.dhcpcd = {};
-
-    systemd.services.unbound = {
-      wantedBy = [ "dhcpcd-${pppInterface}.service" ];
-      bindsTo = [ "dhcpcd-${pppInterface}.service" ];
-      after = [ "dhcpcd-${pppInterface}.service" ];
-
-      serviceConfig = {
-        Restart = lib.mkForce "always";
-      };
-    };
-  };
-}
diff --git a/hosts/vidhar/network/gpon.nix b/hosts/vidhar/network/gpon.nix
new file mode 100644
index 00000000..c15a6e8d
--- /dev/null
+++ b/hosts/vidhar/network/gpon.nix
@@ -0,0 +1,265 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  pppInterface = config.networking.pppInterface;
+in {
+  options = {
+    networking.pppInterface = mkOption {
+      type = types.str;
+      default = "gpon";
+    };
+  };
+
+  config = {
+    networking.vlans = {
+      telekom = {
+        id = 7;
+        interface = "eno2";
+      };
+    };
+
+    services.pppd = {
+      enable = true;
+      peers.telekom.config = ''
+        nodefaultroute
+        ifname ${pppInterface}
+        lcp-echo-adaptive
+        lcp-echo-failure 5
+        lcp-echo-interval 1
+        maxfail 0
+        mtu 1492
+        mru 1492
+        plugin pppoe.so
+        name telekom
+        user 002576900250551137425220#0001@t-online.de
+        nic-telekom
+        debug
+        +ipv6
+      '';
+    };
+    systemd.services."pppd-telekom" = {
+      stopIfChanged = true;
+
+      serviceConfig = {
+        PIDFile = "/run/pppd/${pppInterface}.pid";
+      };
+    };
+    sops.secrets."pap-secrets" = {
+      format = "binary";
+      sopsFile = ./pap-secrets;
+      path = "/etc/ppp/pap-secrets";
+    };
+
+    environment.etc = {
+      "ppp/ip-pre-up".source = let
+        app = pkgs.writeShellApplication {
+          name = "ip-pre-up";
+          runtimeInputs = with pkgs; [ iproute2 ethtool ];
+          text = ''
+            ethtool -K telekom tso off gso off gro off
+
+            ip link del "ifb4${pppInterface}" || true
+            ip link add name "ifb4${pppInterface}" type ifb
+            ip link set "ifb4${pppInterface}" up
+
+            tc qdisc del dev "ifb4${pppInterface}" root || true
+            tc qdisc del dev "${pppInterface}" ingress || true
+            tc qdisc del dev "${pppInterface}" root || true
+
+            tc qdisc add dev "${pppInterface}" handle ffff: ingress
+            tc filter add dev "${pppInterface}" parent ffff: basic action ctinfo dscp 0x0000003f 0x00000040 action mirred egress redirect dev "ifb4${pppInterface}"
+            tc qdisc replace dev "ifb4${pppInterface}" root cake memlimit 128Mb pppoe-ptm diffserv4 bandwidth 238mbit
+            tc qdisc replace dev "${pppInterface}" root cake memlimit 128Mb pppoe-ptm nat diffserv4 wash bandwidth 48mbit
+          '';
+        };
+      in "${app}/bin/${app.meta.mainProgram}";
+      "ppp/ip-up".source = let
+        app = pkgs.writeShellApplication {
+          name = "ip-up";
+          runtimeInputs = with pkgs; [ iproute2 ];
+          text = ''
+            ip route add default via "$5" dev "${pppInterface}" metric 512
+          '';
+        };
+      in "${app}/bin/${app.meta.mainProgram}";
+      "ppp/ip-down".source = let
+        app = pkgs.writeShellApplication {
+          name = "ip-down";
+          runtimeInputs = with pkgs; [ iproute2 ];
+          text = ''
+            ip link del "ifb4${pppInterface}"
+          '';
+        };
+      in "${app}/bin/${app.meta.mainProgram}";
+    };
+
+    systemd.network.networks.${pppInterface} = {
+      matchConfig = {
+        Name = pppInterface;
+      };
+      dns = [ "::1" "127.0.0.1" ];
+      domains = [ "~." ];
+      networkConfig = {
+        LinkLocalAddressing = "no";
+        DNSSEC = true;
+      };
+    };
+
+    services.corerad = {
+      enable = true;
+      settings = {
+        interfaces = [
+          { name = pppInterface;
+            monitor = true;
+            verbose = true;
+          }
+          { name = "lan";
+            advertise = true;
+            verbose = true;
+            prefix = [{ prefix = "::/64"; }];
+            route = [{ prefix = "::/0"; }];
+            rdnss = [{ servers = ["::"]; }];
+            dnssl = [{ domain_names = ["yggdrasil"]; }];
+            # other_config = true;
+          }
+        ];
+
+        debug = {
+          address = "localhost:9430";
+          prometheus = true;
+        };
+      };
+    };
+    services.ndppd = {
+      enable = true;
+      proxies = {
+        ${pppInterface} = {
+          router = true;
+          rules = {
+            lan = {
+              method = "iface";
+              interface = "lan";
+              network = "::/0";
+            };
+          };
+        };
+      };
+    };
+    boot.kernelModules = [ "ifb" ];
+    boot.kernel.sysctl = {
+      "net.ipv6.conf.all.forwarding" = true;
+      "net.ipv6.conf.default.forwarding" = true;
+      "net.ipv4.conf.all.forwarding" = true;
+      "net.ipv4.conf.default.forwarding" = true;
+
+      "net.core.rmem_max" = 4194304;
+      "net.core.wmem_max" = 4194304;
+    };
+    systemd.services."pppd-telekom" = {
+      bindsTo = [ "sys-subsystem-net-devices-telekom.device" ];
+      after = [ "sys-subsystem-net-devices-telekom.device" ];
+    };
+    systemd.services."dhcpcd-${pppInterface}" = {
+      wantedBy = [ "multi-user.target" "network-online.target" "pppd-telekom.service" ];
+      bindsTo = [ "pppd-telekom.service" ];
+      after = [ "pppd-telekom.service" ];
+      wants = [ "network.target" ];
+      before = [ "network-online.target" ];
+
+      path = with pkgs; [ dhcpcd nettools openresolv ];
+      unitConfig.ConditionCapability = "CAP_NET_ADMIN";
+
+      stopIfChanged = true;
+
+      preStart = ''
+        i=0
+
+        while [[ -z "$(${pkgs.iproute2}/bin/ip -6 addr show dev ${pppInterface} scope link)" ]]; do
+          ${pkgs.coreutils}/bin/sleep 0.1
+          i=$((i + 1))
+          if [[ "$i" -ge 10 ]]; then
+            exit 1
+          fi
+        done
+      '';
+
+      postStop = ''
+        for dev in lan; do
+          ${pkgs.iproute2}/bin/ip -6 a show dev "''${dev}" scope global | ${pkgs.gnugrep}/bin/grep inet6 | ${pkgs.gawk}/bin/awk '{ print $2; }' | ${pkgs.findutils}/bin/xargs -I '{}' -- ${pkgs.iproute2}/bin/ip addr del '{}' dev "''${dev}"
+        done
+      '';
+
+      serviceConfig = let
+        dhcpcdConf = pkgs.writeText "dhcpcd.conf" ''
+          duid
+          vendorclassid
+          ipv6only
+
+          nooption domain_name_servers, domain_name, domain_search
+          option classless_static_routes
+          option interface_mtu
+
+          option host_name
+          option rapid_commit
+          require dhcp_server_identifier
+          slaac private
+
+          nohook resolv.conf
+          ipv6ra_autoconf
+          iaid 1195061668
+          ipv6rs                 # enable routing solicitation for WAN adapter
+          ia_pd 1 lan/0/64/0     # request a PD and assign it to the LAN
+
+          reboot 0
+
+          waitip 6
+        '';
+      in {
+        Type = "forking";
+        PIDFile = "/var/run/dhcpcd/${pppInterface}.pid";
+        RuntimeDirectory = "dhcpcd";
+        ExecStart = "@${pkgs.dhcpcd}/sbin/dhcpcd dhcpcd -q --config ${dhcpcdConf} ${pppInterface}";
+        ExecReload = "${pkgs.dhcpcd}/sbin/dhcpcd --rebind ${pppInterface}";
+        Restart = "always";
+        RestartSec = "5";
+      };
+    };
+    systemd.services.ndppd = {
+      wantedBy = [ "dhcpcd-${pppInterface}.service" ];
+      bindsTo = [ "dhcpcd-${pppInterface}.service" ];
+      after = [ "dhcpcd-${pppInterface}.service" ];
+
+      serviceConfig = {
+        Restart = "always";
+        RestartSec = "5";
+      };
+    };
+    systemd.services.corerad = {
+      wantedBy = [ "dhcpcd-${pppInterface}.service" ];
+      bindsTo = [ "dhcpcd-${pppInterface}.service" ];
+      after = [ "dhcpcd-${pppInterface}.service" ];
+
+      serviceConfig = {
+        Restart = lib.mkForce "always";
+        RestartSec = "5";
+      };
+    };
+    users.users.dhcpcd = {
+      isSystemUser = true;
+      group = "dhcpcd";
+    };
+    users.groups.dhcpcd = {};
+
+    systemd.services.unbound = {
+      wantedBy = [ "dhcpcd-${pppInterface}.service" ];
+      bindsTo = [ "dhcpcd-${pppInterface}.service" ];
+      after = [ "dhcpcd-${pppInterface}.service" ];
+
+      serviceConfig = {
+        Restart = lib.mkForce "always";
+      };
+    };
+  };
+}
diff --git a/hosts/vidhar/network/ruleset.nft b/hosts/vidhar/network/ruleset.nft
index 6eb97f85..9843b71a 100644
--- a/hosts/vidhar/network/ruleset.nft
+++ b/hosts/vidhar/network/ruleset.nft
@@ -4,15 +4,15 @@ table arp filter {
   limit lim_arp_local {
     rate over 50 mbytes/second burst 50 mbytes
   }
-  limit lim_arp_dsl {
-    rate over 1400 kbytes/second burst 1400 kbytes
+  limit lim_arp_gpon {
+    rate over 1750 kbytes/second burst 1750 kbytes
   }
 
   counter arp-rx {}
   counter arp-tx {}
 
-  counter arp-ratelimit-dsl-rx {}
-  counter arp-ratelimit-dsl-tx {}
+  counter arp-ratelimit-gpon-rx {}
+  counter arp-ratelimit-gpon-tx {}
 
   counter arp-ratelimit-local-rx {}
   counter arp-ratelimit-local-tx {}
@@ -21,8 +21,8 @@ table arp filter {
     type filter hook input priority filter
     policy accept
 
-    iifname != dsl limit name lim_arp_local counter name arp-ratelimit-local-rx drop
-    iifname dsl limit name lim_arp_dsl counter name arp-ratelimit-dsl-rx drop
+    iifname != gpon limit name lim_arp_local counter name arp-ratelimit-local-rx drop
+    iifname gpon limit name lim_arp_gpon counter name arp-ratelimit-gpon-rx drop
 
     counter name arp-rx
   }
@@ -31,8 +31,8 @@ table arp filter {
     type filter hook output priority filter
     policy accept
 
-    oifname != dsl limit name lim_arp_local counter name arp-ratelimit-local-tx drop
-    oifname dsl limit name lim_arp_dsl counter name arp-ratelimit-dsl-tx drop
+    oifname != gpon limit name lim_arp_local counter name arp-ratelimit-local-tx drop
+    oifname gpon limit name lim_arp_gpon counter name arp-ratelimit-gpon-tx drop
 
     counter name arp-tx
   }
@@ -46,11 +46,11 @@ table inet filter {
   limit lim_icmp_local {
     rate over 50 mbytes/second burst 50 mbytes
   }
-  limit lim_icmp_dsl {
-    rate over 1400 kbytes/second burst 1400 kbytes
+  limit lim_icmp_gpon {
+    rate over 1750 kbytes/second burst 1750 kbytes
   }
 
-  counter icmp-ratelimit-dsl-fw {}
+  counter icmp-ratelimit-gpon-fw {}
   counter icmp-ratelimit-local-fw {}
 
   counter icmp-fw {}
@@ -58,7 +58,7 @@ table inet filter {
   counter invalid-fw {}
   counter fw-lo {}
   counter fw-lan {}
-  counter fw-dsl {}
+  counter fw-gpon {}
 
   counter fw-cups {}
 
@@ -73,7 +73,7 @@ table inet filter {
   counter invalid-local4-rx {}
   counter invalid-local6-rx {}
 
-  counter icmp-ratelimit-dsl-rx {}
+  counter icmp-ratelimit-gpon-rx {}
   counter icmp-ratelimit-local-rx {}
   counter icmp-rx {}
 
@@ -101,7 +101,7 @@ table inet filter {
 
   counter tx-lo {}
 
-  counter icmp-ratelimit-dsl-tx {}
+  counter icmp-ratelimit-gpon-tx {}
   counter icmp-ratelimit-local-tx {}
   counter icmp-tx {}
 
@@ -123,10 +123,10 @@ table inet filter {
 
 
   chain forward_icmp_accept {
-    oifname { dsl, bifrost } limit name lim_icmp_dsl counter name icmp-ratelimit-dsl-fw drop
-    iifname { dsl, bifrost } limit name lim_icmp_dsl counter name icmp-ratelimit-dsl-fw drop
-    oifname != { dsl, bifrost } limit name lim_icmp_local counter name icmp-ratelimit-local-fw drop
-    iifname != { dsl, bifrost } limit name lim_icmp_local counter name icmp-ratelimit-local-fw drop
+    oifname { gpon, bifrost } limit name lim_icmp_gpon counter name icmp-ratelimit-gpon-fw drop
+    iifname { gpon, bifrost } limit name lim_icmp_gpon counter name icmp-ratelimit-gpon-fw drop
+    oifname != { gpon, bifrost } limit name lim_icmp_local counter name icmp-ratelimit-local-fw drop
+    iifname != { gpon, bifrost } limit name lim_icmp_local counter name icmp-ratelimit-local-fw drop
     counter name icmp-fw accept
   }
   chain forward {
@@ -139,10 +139,10 @@ table inet filter {
 
     iifname lo counter name fw-lo accept
 
-    oifname { lan, dsl, bifrost } meta l4proto $icmp_protos jump forward_icmp_accept
-    iifname lan oifname { dsl, bifrost } counter name fw-lan accept
+    oifname { lan, gpon, bifrost } meta l4proto $icmp_protos jump forward_icmp_accept
+    iifname lan oifname { gpon, bifrost } counter name fw-lan accept
 
-    iifname dsl oifname lan ct state { established, related } counter name fw-dsl accept
+    iifname gpon oifname lan ct state { established, related } counter name fw-gpon accept
 
 
     limit name lim_reject log level debug prefix "drop forward: " counter name reject-ratelimit-fw drop
@@ -163,22 +163,22 @@ table inet filter {
     iif != lo ip daddr 127.0.0.1/8 counter name invalid-local4-rx reject
     iif != lo ip6 daddr ::1/128 counter name invalid-local6-rx reject
 
-    iifname { bifrost, dsl } meta l4proto $icmp_protos limit name lim_icmp_dsl counter name icmp-ratelimit-dsl-rx drop
-    iifname != { bifrost, dsl } meta l4proto $icmp_protos limit name lim_icmp_local counter name icmp-ratelimit-local-rx drop
+    iifname { bifrost, gpon } meta l4proto $icmp_protos limit name lim_icmp_gpon counter name icmp-ratelimit-gpon-rx drop
+    iifname != { bifrost, gpon } meta l4proto $icmp_protos limit name lim_icmp_local counter name icmp-ratelimit-local-rx drop
     meta l4proto $icmp_protos counter name icmp-rx accept
 
-    iifname { lan, mgmt, dsl, yggdrasil, bifrost } tcp dport 22 counter name ssh-rx accept
-    iifname { lan, mgmt, dsl, yggdrasil, bifrost } udp dport 60000-61000 counter name mosh-rx accept
+    iifname { lan, mgmt, gpon, yggdrasil, bifrost } tcp dport 22 counter name ssh-rx accept
+    iifname { lan, mgmt, gpon, yggdrasil, bifrost } udp dport 60000-61000 counter name mosh-rx accept
 
     iifname { lan, mgmt, wifibh, yggdrasil } meta l4proto { tcp, udp } th dport 53 counter name dns-rx accept
 
     iifname { lan, yggdrasil } tcp dport 2049 counter name nfs-rx accept
 
-    iifname { lan, mgmt, dsl } meta protocol ip udp dport 51820 counter name wg-rx accept
-    iifname { lan, mgmt, dsl } meta protocol ip6 udp dport 51821 counter name wg-rx accept
+    iifname { lan, mgmt, gpon } meta protocol ip udp dport 51820 counter name wg-rx accept
+    iifname { lan, mgmt, gpon } meta protocol ip6 udp dport 51821 counter name wg-rx accept
     iifname "yggdrasil-wg-*" meta l4proto gre counter name yggdrasil-gre-rx accept
 
-    iifname dsl meta protocol ip6 udp dport 546 udp sport 547 counter name ipv6-pd-rx accept
+    iifname gpon meta protocol ip6 udp dport 546 udp sport 547 counter name ipv6-pd-rx accept
 
     iifname mgmt udp dport 123 counter name ntp-rx accept
 
@@ -209,8 +209,8 @@ table inet filter {
 
     oifname lo counter name tx-lo accept
 
-    oifname { bifrost, dsl } meta l4proto $icmp_protos limit name lim_icmp_dsl counter name icmp-ratelimit-dsl-tx drop
-    oifname != { bifrost, dsl } meta l4proto $icmp_protos limit name lim_icmp_local counter name icmp-ratelimit-local-tx drop
+    oifname { bifrost, gpon } meta l4proto $icmp_protos limit name lim_icmp_gpon counter name icmp-ratelimit-gpon-tx drop
+    oifname != { bifrost, gpon } meta l4proto $icmp_protos limit name lim_icmp_local counter name icmp-ratelimit-local-tx drop
     meta l4proto $icmp_protos counter name icmp-tx accept
 
 
@@ -246,7 +246,7 @@ table inet filter {
 }
 
 table inet nat {
-  counter dsl-nat {}
+  counter gpon-nat {}
   # counter container-nat {}
 
   chain postrouting {
@@ -254,20 +254,20 @@ table inet nat {
     policy accept
 
 
-    meta nfproto ipv4 oifname dsl counter name dsl-nat masquerade
-    # iifname ve-* oifname dsl counter name container-nat masquerade
+    meta nfproto ipv4 oifname gpon counter name gpon-nat masquerade
+    # iifname ve-* oifname gpon counter name container-nat masquerade
   }
 }
 
 table inet mss_clamp {
-  counter dsl-mss-clamp {}
+  counter gpon-mss-clamp {}
 
   chain postrouting {
     type filter hook postrouting priority mangle
     policy accept
 
 
-    oifname dsl tcp flags & (syn|rst) == syn counter name dsl-mss-clamp tcp option maxseg size set rt mtu
+    oifname gpon tcp flags & (syn|rst) == syn counter name gpon-mss-clamp tcp option maxseg size set rt mtu
   }
 }
 
@@ -402,7 +402,7 @@ table inet dscpclassify {
     chain postrouting {
 	type filter hook postrouting priority filter + 1; policy accept
 
-	oifname != dsl return
+	oifname != gpon return
 
 	ip dscp cs0 goto ct_set_cs0
 	ip dscp lephb goto ct_set_lephb
-- 
cgit v1.2.3