greg/nixos
1
0
Fork 2
Code Issues Pull Requests 2 Actions Packages Projects Releases Wiki Activity

Back to dnsmasq

Browse Source
This commit is contained in:
Greg Hellings
2023-05-05 17:30:12 -05:00
parent b70f6179db
commit 5b35878c31
2 changed files with 20 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hosts/mm/default.nix
+13 -6
View File
@@ -26,7 +26,7 @@ in
networking = { networking = {
hostName = "mm"; hostName = "mm";
domain = "mindmazeroom.lan"; domain = "mindmazeroom.lan";
nameservers = [ lanIpAddress ]; #nameservers = [ "127.0.0.53" ];
interfaces = { interfaces = {
"${wanInterface}".useDHCP = true; "${wanInterface}".useDHCP = true;
"${lanInterface}" = { "${lanInterface}" = {
@@ -46,14 +46,21 @@ in
# Serves as the router, DHCP, and DNS for the site # Serves as the router, DHCP, and DNS for the site
greg.router = { greg.router = {
enable = true; enable = true;
wan = wanInterface; wan = [ wanInterface "tailscale0" ];
lan = [ lanInterface ]; lan = [ lanInterface ];
}; };
greg.tailscale.enable = true;
services = { services = {
bind = { dnsmasq = {
enable = false; enable = true;
cacheNetworks = [ "127.0.0.1/24" "${lanIpAddress}/24" ]; settings = {
listenOn = [ lanInterface ]; domain = "mindmazeroom.lan";
server = [
"1.1.1.1"
"100.100.100.100"
"8.8.8.8"
];
};
}; };
create_ap = { create_ap = {
enable = false; enable = false;
modules-linux/router.nix
+7 -6
View File
@@ -7,17 +7,18 @@ let
let let
lanList = names lan; lanList = names lan;
allLan = names (lan ++ limitedLan); allLan = names (lan ++ limitedLan);
wanName = ''"${wan}"''; wanName = names wan;
in in
'' ''
table ip filter { table ip filter {
chain input { chain input {
type filter hook input priority 0; policy drop; type filter hook input priority 0; policy drop;
iifname lo accept
iifname { ${lanList} } accept comment "Allows LAN traffic and outgoing" iifname { ${lanList} } accept comment "Allows LAN traffic and outgoing"
iifname ${wanName} ct state { established, related } accept comment "Allows existing connections" iifname { ${wanName} } ct state { established, related } accept comment "Allows existing connections"
iifname ${wanName} icmp type { echo-request, destination-unreachable, time-exceeded } counter accept comment "Allow some ICMP traffic" iifname { ${wanName} } icmp type { echo-request, destination-unreachable, time-exceeded } counter accept comment "Allow some ICMP traffic"
iifname ${wanName} counter drop comment "Drop other incoming traffic, and count how much" iifname { ${wanName} } counter drop comment "Drop other incoming traffic, and count how much"
} }
chain forward { chain forward {
type filter hook forward priority 0; policy drop; type filter hook forward priority 0; policy drop;
@@ -29,7 +30,7 @@ table ip filter {
table ip nat { table ip nat {
chain postrouting { chain postrouting {
type nat hook postrouting priority 100; policy accept; type nat hook postrouting priority 100; policy accept;
oifname "${wan}" masquerade oifname { ${wanName} } masquerade
} }
} }
@@ -48,7 +49,7 @@ in with lib; {
options.greg.router = { options.greg.router = {
enable = mkEnableOption "Enable NFTables and routing"; enable = mkEnableOption "Enable NFTables and routing";
wan = mkOption { wan = mkOption {
type = types.str; type = (types.listOf types.str);
description = "The name of the network interface that is the WAN connection"; description = "The name of the network interface that is the WAN connection";
}; };
lan = mkOption { lan = mkOption {